{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b41f5d8c-f80d-454f-86e8-246bcc38427e",
  "version": 1,
  "metadata": {
    "timestamp": "2026-06-10T00:30:43+00:00",
    "tools": {
      "components": [
        {
          "type": "application",
          "manufacturer": {
            "name": "Aqua Security Software Ltd."
          },
          "group": "aquasecurity",
          "name": "trivy",
          "version": "0.69.3"
        }
      ]
    },
    "component": {
      "bom-ref": "pkg:oci/cp-zookeeper@sha256%3A6933c4b6f5b3387f6024903a0f52027936bdbf925ad4668fcd1e2b28f865b8ce?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-zookeeper",
      "type": "container",
      "supplier": {
        "name": "Confluent"
      },
      "name": "cp-zookeeper",
      "version": "7.6.11",
      "purl": "pkg:oci/cp-zookeeper@sha256%3A6933c4b6f5b3387f6024903a0f52027936bdbf925ad4668fcd1e2b28f865b8ce?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-zookeeper",
      "properties": [
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:1a358a224b074894b5f6ba6e693cbfbbf7db24849e841f26796b4c83562d7490"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:309f77d018eba3874ce8c31cc28598c93f682c6e576d98a481c046f4eb571d40"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:704b90229b496dee458bda527b79db8eac0c45717fffe2efbb61dc0aaeb6b341"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:7b346848880ca1bb7154b271bbc7390f425ef9bf0f159d159a2817677791b1ff"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:8520c5b71a83060b04ebb5a1b0ff71c1a40ee768b92303cff76054de17c1eb61"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:8afd81b780f016acaa71d1e0ac218d88515f24eb9c66a67c3f06586e0bf72173"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:90bc19bcda659ed012c82a2157b8ba187060058ad20a0e1bbf3fec137269b0f5"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:91b59ff17517e37a5c1dae71ce8dcb316ff977c363c7bed2329ecc4439caabb9"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:9fd904d65463ae5def67d4ed6998e9764ef6bb5802f9cf9ee7e107329f1a358d"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:b3a5a2fda91693d8e9f7981c70b66779366edac304bbabce605632fc71f59322"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:fad74feb41ea1b6d9dd6ad226b7e6c8692045023eddba2ae446878297ee12022"
        },
        {
          "name": "aquasecurity:trivy:ImageID",
          "value": "sha256:103cf2bfbb24b448af7336111ddc8aea6e28ec12b0f528628b1f90d7a9ec686b"
        },
        {
          "name": "aquasecurity:trivy:Labels:architecture",
          "value": "x86_64"
        },
        {
          "name": "aquasecurity:trivy:Labels:build-date",
          "value": "2026-05-06T12:54:39Z"
        },
        {
          "name": "aquasecurity:trivy:Labels:com.redhat.component",
          "value": "ubi8-minimal-container"
        },
        {
          "name": "aquasecurity:trivy:Labels:com.redhat.license_terms",
          "value": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI"
        },
        {
          "name": "aquasecurity:trivy:Labels:cpe",
          "value": "cpe:/a:redhat:enterprise_linux:8::appstream"
        },
        {
          "name": "aquasecurity:trivy:Labels:description",
          "value": "ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services."
        },
        {
          "name": "aquasecurity:trivy:Labels:distribution-scope",
          "value": "public"
        },
        {
          "name": "aquasecurity:trivy:Labels:io.buildah.version",
          "value": "1.42.2"
        },
        {
          "name": "aquasecurity:trivy:Labels:io.confluent.docker",
          "value": "true"
        },
        {
          "name": "aquasecurity:trivy:Labels:io.confluent.docker.build.number",
          "value": "a175f6b9"
        },
        {
          "name": "aquasecurity:trivy:Labels:io.confluent.docker.git.id",
          "value": "a5591d3"
        },
        {
          "name": "aquasecurity:trivy:Labels:io.confluent.docker.git.repo",
          "value": "confluentinc/kafka-images"
        },
        {
          "name": "aquasecurity:trivy:Labels:io.k8s.description",
          "value": "The Universal Base Image Minimal is a stripped down image that uses microdnf as a package manager. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly."
        },
        {
          "name": "aquasecurity:trivy:Labels:io.k8s.display-name",
          "value": "Red Hat Universal Base Image 8 Minimal"
        },
        {
          "name": "aquasecurity:trivy:Labels:io.openshift.tags",
          "value": "minimal rhel8"
        },
        {
          "name": "aquasecurity:trivy:Labels:maintainer",
          "value": "partner-support@confluent.io"
        },
        {
          "name": "aquasecurity:trivy:Labels:name",
          "value": "cp-zookeeper"
        },
        {
          "name": "aquasecurity:trivy:Labels:org.opencontainers.image.created",
          "value": "2026-05-06T12:54:39Z"
        },
        {
          "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision",
          "value": "96acc9b46c4dd3b5e14eb20482260cf863202c68"
        },
        {
          "name": "aquasecurity:trivy:Labels:release",
          "value": "7.6.11-26"
        },
        {
          "name": "aquasecurity:trivy:Labels:summary",
          "value": "ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services."
        },
        {
          "name": "aquasecurity:trivy:Labels:url",
          "value": "https://catalog.redhat.com/en/search?searchType=containers"
        },
        {
          "name": "aquasecurity:trivy:Labels:vcs-ref",
          "value": "96acc9b46c4dd3b5e14eb20482260cf863202c68"
        },
        {
          "name": "aquasecurity:trivy:Labels:vcs-type",
          "value": "git"
        },
        {
          "name": "aquasecurity:trivy:Labels:vendor",
          "value": "Confluent"
        },
        {
          "name": "aquasecurity:trivy:Labels:version",
          "value": "a5591d3"
        },
        {
          "name": "aquasecurity:trivy:Reference",
          "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper:7.6.11-rc260508095844-latest-ubi8"
        },
        {
          "name": "aquasecurity:trivy:RepoDigest",
          "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper@sha256:6933c4b6f5b3387f6024903a0f52027936bdbf925ad4668fcd1e2b28f865b8ce"
        },
        {
          "name": "aquasecurity:trivy:RepoTag",
          "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper:7.6.11-rc260508095844-latest-ubi8"
        },
        {
          "name": "aquasecurity:trivy:SchemaVersion",
          "value": "2"
        },
        {
          "name": "aquasecurity:trivy:Size",
          "value": "752984576"
        }
      ]
    }
  },
  "components": [],
  "dependencies": [],
  "vulnerabilities": [
    {
      "id": "CVE-2005-2541",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 10,
          "severity": "high",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2005-2541"
        },
        {
          "url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2005-2541"
        },
        {
          "url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2541"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-2541"
        }
      ],
      "published": "2005-08-10T04:00:00+00:00",
      "updated": "2026-04-16T00:27:16+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2018-1000654",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.1,
          "severity": "high",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-1000654"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html"
        },
        {
          "url": "http://www.securityfocus.com/bid/105151"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-1000654"
        },
        {
          "url": "https://gitlab.com/gnutls/libtasn1/issues/4"
        },
        {
          "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000654"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5352-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000654"
        }
      ],
      "published": "2018-08-20T19:31:44+00:00",
      "updated": "2024-11-21T03:40:20+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.13-5.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2018-1000879",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        476
      ],
      "description": "libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-1000879"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html"
        },
        {
          "url": "http://www.securityfocus.com/bid/106324"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-1000879"
        },
        {
          "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/1105"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000879"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000879"
        }
      ],
      "published": "2018-12-20T17:29:01+00:00",
      "updated": "2024-11-21T03:40:34+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2018-1000880",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        119
      ],
      "description": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-1000880"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html"
        },
        {
          "url": "http://www.securityfocus.com/bid/106324"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-1000880"
        },
        {
          "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/1105"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000880"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-3859-1"
        },
        {
          "url": "https://usn.ubuntu.com/3859-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000880"
        },
        {
          "url": "https://www.debian.org/security/2018/dsa-4360"
        }
      ],
      "published": "2018-12-20T17:29:01+00:00",
      "updated": "2024-11-21T03:40:34+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2018-1121",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.9,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        367,
        362
      ],
      "description": "procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-1121"
        },
        {
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-1121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1121"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1121"
        },
        {
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        }
      ],
      "published": "2018-06-13T20:29:00+00:00",
      "updated": "2024-11-21T03:59:13+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.15-14.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2018-19211",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-19211"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-19211"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1643754"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19211"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5477-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-19211"
        }
      ],
      "published": "2018-11-12T19:29:00+00:00",
      "updated": "2024-11-21T03:57:34+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2018-20225",
      "ratings": [
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.8,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        20
      ],
      "description": "An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-20225"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-20225"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1835736"
        },
        {
          "url": "https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html"
        },
        {
          "url": "https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20225"
        },
        {
          "url": "https://pip.pypa.io/en/stable/news/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-20225"
        }
      ],
      "published": "2020-05-08T18:15:10+00:00",
      "updated": "2026-04-15T21:17:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable. "
      }
    },
    {
      "id": "CVE-2018-20657",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        772
      ],
      "description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-20657"
        },
        {
          "url": "http://www.securityfocus.com/bid/106444"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2019:3352"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-20657"
        },
        {
          "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2018-20657.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2019-3352.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20657"
        },
        {
          "url": "https://support.f5.com/csp/article/K62602089"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-20657"
        }
      ],
      "published": "2019-01-02T14:29:00+00:00",
      "updated": "2024-11-21T04:01:56+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "8.5.0-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "8.5.0-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2018-20839",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "description": "systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-20839"
        },
        {
          "url": "http://www.securityfocus.com/bid/108389"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-20839"
        },
        {
          "url": "https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f"
        },
        {
          "url": "https://github.com/systemd/systemd/pull/12378"
        },
        {
          "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20839"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20190530-0002/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-20839"
        }
      ],
      "published": "2019-05-17T04:29:00+00:00",
      "updated": "2025-05-05T14:14:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2018-25282",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        674
      ],
      "description": "Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2018-25282"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2018-25282"
        },
        {
          "url": "https://nmap.org/dist/nmap-7.70-setup.exe"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25282"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-25282"
        },
        {
          "url": "https://www.exploit-db.com/exploits/45357"
        },
        {
          "url": "https://www.vulncheck.com/advisories/nmap-denial-of-service-via-xml-entity-expansion"
        }
      ],
      "published": "2026-04-26T22:17:28+00:00",
      "updated": "2026-04-27T18:55:32+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:7.92-2.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2019-12904",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "cwes": [
        668
      ],
      "description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-12904"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-12904"
        },
        {
          "url": "https://dev.gnupg.org/T4541"
        },
        {
          "url": "https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020"
        },
        {
          "url": "https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762"
        },
        {
          "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
        },
        {
          "url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2019-July/004760.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12904"
        },
        {
          "url": "https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12904.html"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12904"
        }
      ],
      "published": "2019-06-20T00:15:10+00:00",
      "updated": "2024-11-21T04:23:48+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.8.5-7.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2019-14250",
      "ratings": [
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        190,
        787
      ],
      "description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-14250"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html"
        },
        {
          "url": "http://www.securityfocus.com/bid/109354"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-14250"
        },
        {
          "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924"
        },
        {
          "url": "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14250"
        },
        {
          "url": "https://security.gentoo.org/glsa/202007-39"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20190822-0002/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4326-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4336-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4336-2"
        },
        {
          "url": "https://usn.ubuntu.com/4326-1/"
        },
        {
          "url": "https://usn.ubuntu.com/4336-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-14250"
        }
      ],
      "published": "2019-07-24T04:15:12+00:00",
      "updated": "2024-11-21T04:26:17+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "8.5.0-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "8.5.0-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2019-16866",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        755,
        908
      ],
      "description": "Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-16866"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-16866"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/"
        },
        {
          "url": "https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16866"
        },
        {
          "url": "https://seclists.org/bugtraq/2019/Oct/23"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4149-1"
        },
        {
          "url": "https://usn.ubuntu.com/4149-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-16866"
        },
        {
          "url": "https://www.debian.org/security/2019/dsa-4544"
        }
      ],
      "published": "2019-10-03T19:15:09+00:00",
      "updated": "2024-11-21T04:31:14+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2019-19244",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "description": "sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-19244"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-19244"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "url": "https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19244"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4205-1"
        },
        {
          "url": "https://usn.ubuntu.com/4205-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-19244"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        }
      ],
      "published": "2019-11-25T20:15:11+00:00",
      "updated": "2024-11-21T04:34:24+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.26.0-20.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2019-8905",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 3.6,
          "severity": "info",
          "method": "CVSSv2",
          "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        125
      ],
      "description": "do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-8905"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html"
        },
        {
          "url": "http://www.securityfocus.com/bid/107137"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-8905"
        },
        {
          "url": "https://bugs.astron.com/view.php?id=63"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00044.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8905"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-3911-1"
        },
        {
          "url": "https://usn.ubuntu.com/3911-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-8905"
        }
      ],
      "published": "2019-02-18T17:29:00+00:00",
      "updated": "2024-11-21T04:50:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "5.33-27.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable.\nFor python:"
      }
    },
    {
      "id": "CVE-2019-8906",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 3.6,
          "severity": "info",
          "method": "CVSSv2",
          "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.4,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        125
      ],
      "description": "do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-8906"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-8906"
        },
        {
          "url": "https://bugs.astron.com/view.php?id=64"
        },
        {
          "url": "https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8906"
        },
        {
          "url": "https://support.apple.com/kb/HT209599"
        },
        {
          "url": "https://support.apple.com/kb/HT209600"
        },
        {
          "url": "https://support.apple.com/kb/HT209601"
        },
        {
          "url": "https://support.apple.com/kb/HT209602"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-3911-1"
        },
        {
          "url": "https://usn.ubuntu.com/3911-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-8906"
        }
      ],
      "published": "2019-02-18T17:29:01+00:00",
      "updated": "2024-11-21T04:50:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "5.33-27.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable.\nFor python:"
      }
    },
    {
      "id": "CVE-2019-9674",
      "ratings": [
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.2,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        400
      ],
      "description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-9674"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-9674"
        },
        {
          "url": "https://bugs.python.org/issue36260"
        },
        {
          "url": "https://bugs.python.org/issue36462"
        },
        {
          "url": "https://github.com/python/cpython/blob/master/Lib/zipfile.py"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9674"
        },
        {
          "url": "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20200221-0003/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4428-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4754-3"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6891-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7212-1"
        },
        {
          "url": "https://usn.ubuntu.com/4428-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-9674"
        },
        {
          "url": "https://www.python.org/news/security/"
        }
      ],
      "published": "2020-02-04T15:15:11+00:00",
      "updated": "2025-12-31T00:55:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2019-9923",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-9923"
        },
        {
          "url": "http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html"
        },
        {
          "url": "http://savannah.gnu.org/bugs/?55369"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-9923"
        },
        {
          "url": "https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241"
        },
        {
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9923"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4692-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-9923"
        }
      ],
      "published": "2019-03-22T08:29:00+00:00",
      "updated": "2025-08-06T22:15:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2019-9936",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        125
      ],
      "description": "In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-9936"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html"
        },
        {
          "url": "http://www.securityfocus.com/bid/107562"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-9936"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9936"
        },
        {
          "url": "https://security.gentoo.org/glsa/201908-09"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20190416-0005/"
        },
        {
          "url": "https://sqlite.org/src/info/b3fa58dd7403dbd4"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4019-1"
        },
        {
          "url": "https://usn.ubuntu.com/4019-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-9936"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114382.html"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114394.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        }
      ],
      "published": "2019-03-22T08:29:00+00:00",
      "updated": "2024-11-21T04:52:37+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.26.0-20.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2019-9937",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2019-9937"
        },
        {
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html"
        },
        {
          "url": "http://www.securityfocus.com/bid/107562"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2019-9937"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9937"
        },
        {
          "url": "https://security.gentoo.org/glsa/201908-09"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20190416-0005/"
        },
        {
          "url": "https://sqlite.org/src/info/45c73deb440496e8"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4019-1"
        },
        {
          "url": "https://usn.ubuntu.com/4019-1/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-9937"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114383.html"
        },
        {
          "url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114393.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        }
      ],
      "published": "2019-03-22T08:29:00+00:00",
      "updated": "2024-11-21T04:52:37+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.26.0-20.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2020-19185",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2020-19185"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/11"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2020-19185"
        },
        {
          "url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc1.md"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19185"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
        },
        {
          "url": "https://support.apple.com/kb/HT214036"
        },
        {
          "url": "https://support.apple.com/kb/HT214037"
        },
        {
          "url": "https://support.apple.com/kb/HT214038"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-19185"
        }
      ],
      "published": "2023-08-22T19:15:57+00:00",
      "updated": "2024-11-21T05:09:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2020-19186",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2020-19186"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/11"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2020-19186"
        },
        {
          "url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc2.md"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19186"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
        },
        {
          "url": "https://support.apple.com/kb/HT214036"
        },
        {
          "url": "https://support.apple.com/kb/HT214037"
        },
        {
          "url": "https://support.apple.com/kb/HT214038"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-19186"
        }
      ],
      "published": "2023-08-22T19:15:58+00:00",
      "updated": "2024-11-21T05:09:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2020-19187",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2020-19187"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/11"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2020-19187"
        },
        {
          "url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc3.md"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19187"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
        },
        {
          "url": "https://support.apple.com/kb/HT214036"
        },
        {
          "url": "https://support.apple.com/kb/HT214037"
        },
        {
          "url": "https://support.apple.com/kb/HT214038"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-19187"
        }
      ],
      "published": "2023-08-22T19:15:59+00:00",
      "updated": "2024-11-21T05:09:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2020-19188",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2020-19188"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/11"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2020-19188"
        },
        {
          "url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc4.md"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19188"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
        },
        {
          "url": "https://support.apple.com/kb/HT214036"
        },
        {
          "url": "https://support.apple.com/kb/HT214037"
        },
        {
          "url": "https://support.apple.com/kb/HT214038"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-19188"
        }
      ],
      "published": "2023-08-22T19:16:00+00:00",
      "updated": "2024-11-21T05:09:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2020-19189",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2020-19189"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/11"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2020-19189"
        },
        {
          "url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19189"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
        },
        {
          "url": "https://support.apple.com/kb/HT214036"
        },
        {
          "url": "https://support.apple.com/kb/HT214037"
        },
        {
          "url": "https://support.apple.com/kb/HT214038"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6451-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-19189"
        }
      ],
      "published": "2023-08-22T19:16:01+00:00",
      "updated": "2024-11-21T05:09:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2020-19190",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2020-19190"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/11"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2020-19190"
        },
        {
          "url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19190"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
        },
        {
          "url": "https://support.apple.com/kb/HT214036"
        },
        {
          "url": "https://support.apple.com/kb/HT214037"
        },
        {
          "url": "https://support.apple.com/kb/HT214038"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-19190"
        }
      ],
      "published": "2023-08-22T19:16:01+00:00",
      "updated": "2024-11-21T05:09:01+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2020-35512",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.2,
          "severity": "high",
          "method": "CVSSv2",
          "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.8,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        416
      ],
      "description": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2020-35512"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2020-35512"
        },
        {
          "url": "https://bugs.gentoo.org/755392"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"
        },
        {
          "url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/2b7948ef907669e844b52c4fa2268d6e3162a70c"
        },
        {
          "url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/dc94fe3d31adf72259adc31f343537151a6c0bdd"
        },
        {
          "url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/f3b2574f0c9faa32a59efec905921f7ef4438a60"
        },
        {
          "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305"
        },
        {
          "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35512"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5244-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5244-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-35512"
        }
      ],
      "published": "2021-02-15T17:15:12+00:00",
      "updated": "2024-11-21T05:27:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.12.8-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.12.8-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.12.8-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.12.8-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.12.8-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2021-20193",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        401,
        125
      ],
      "description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2021-20193"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-20193"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917565"
        },
        {
          "url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20193"
        },
        {
          "url": "https://savannah.gnu.org/bugs/?59897"
        },
        {
          "url": "https://security.gentoo.org/glsa/202105-29"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5329-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-20193"
        }
      ],
      "published": "2021-03-26T17:15:12+00:00",
      "updated": "2025-05-05T14:15:04+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2021-24032",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 1.9,
          "severity": "info",
          "method": "CVSSv2",
          "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        277,
        276
      ],
      "description": "Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2021-24032"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-24032"
        },
        {
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519"
        },
        {
          "url": "https://github.com/advisories/GHSA-ffqj-7pgc-cmj5"
        },
        {
          "url": "https://github.com/facebook/zstd/issues/2491"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24032"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-4760-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5720-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-24032"
        },
        {
          "url": "https://www.facebook.com/security/advisories/cve-2021-24032"
        }
      ],
      "published": "2021-03-04T21:15:12+00:00",
      "updated": "2024-11-21T05:52:14+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.4.4-1.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2021-31879",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.8,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        601
      ],
      "description": "GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2021-31879"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-31879"
        },
        {
          "url": "https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31879"
        },
        {
          "url": "https://savannah.gnu.org/bugs/?56909"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210618-0002/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-31879"
        }
      ],
      "published": "2021-04-29T05:15:08+00:00",
      "updated": "2024-11-21T06:06:25+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.19.5-12.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2021-39537",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 8.8,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        787
      ],
      "description": "An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2021-39537"
        },
        {
          "url": "http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2022/Oct/28"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2022/Oct/41"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2022/Oct/43"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2022/Oct/45"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-39537"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html"
        },
        {
          "url": "https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html"
        },
        {
          "url": "https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39537"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0012/"
        },
        {
          "url": "https://support.apple.com/kb/HT213443"
        },
        {
          "url": "https://support.apple.com/kb/HT213444"
        },
        {
          "url": "https://support.apple.com/kb/HT213488"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5477-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6099-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39537"
        }
      ],
      "published": "2021-09-20T16:15:12+00:00",
      "updated": "2024-11-21T06:19:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2021-3997",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        674
      ],
      "description": "A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2021-3997"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-3997"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024639"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3997"
        },
        {
          "url": "https://security.gentoo.org/glsa/202305-15"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5226-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3997"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2022/01/10/2"
        }
      ],
      "published": "2022-08-23T20:15:08+00:00",
      "updated": "2024-11-21T06:23:20+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2021-4209",
      "ratings": [
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2021-4209"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-4209"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044156"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1306"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/merge_requests/1503"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4209"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220915-0005/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5550-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5750-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-4209"
        }
      ],
      "published": "2022-08-24T16:15:09+00:00",
      "updated": "2024-11-21T06:37:09+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2022-0391",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "bitnami"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        74
      ],
      "description": "A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2022-0391"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2022:6457"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-0391"
        },
        {
          "url": "https://bugs.python.org/issue43882"
        },
        {
          "url": "https://bugzilla.redhat.com/2047376"
        },
        {
          "url": "https://bugzilla.redhat.com/2075390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995162"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995234"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2006792"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032569"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2036020"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2047376"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3733"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4189"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43818"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0391"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2022-6457.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2022:1821"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2022-0391.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2023-3550.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0391"
        },
        {
          "url": "https://security.gentoo.org/glsa/202305-02"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220225-0009/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5342-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5342-2"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6891-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-0391"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "published": "2022-02-09T23:15:16+00:00",
      "updated": "2025-12-17T21:15:52+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
          "versions": [
            {
              "version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2022-27943",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        674
      ],
      "description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2022-27943"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-27943"
        },
        {
          "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
        },
        {
          "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371"
        },
        {
          "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79"
        },
        {
          "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead"
        },
        {
          "url": "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27943"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-27943"
        }
      ],
      "published": "2022-03-26T13:15:07+00:00",
      "updated": "2024-11-21T06:56:31+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "8.5.0-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "8.5.0-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2022-3219",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.2,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2022-3219"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-3219"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
        },
        {
          "url": "https://dev.gnupg.org/D556"
        },
        {
          "url": "https://dev.gnupg.org/T5993"
        },
        {
          "url": "https://marc.info/?l=oss-security&m=165696590211434&w=4"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3219"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-3219"
        }
      ],
      "published": "2023-02-23T20:15:12+00:00",
      "updated": "2025-03-12T21:15:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.2.20-4.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2022-41409",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        190
      ],
      "description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2022-41409"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-41409"
        },
        {
          "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35"
        },
        {
          "url": "https://github.com/PCRE2Project/pcre2/issues/141"
        },
        {
          "url": "https://github.com/advisories/GHSA-4qfx-v7wh-3q4j"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-41409"
        }
      ],
      "published": "2023-07-18T14:15:12+00:00",
      "updated": "2024-11-21T07:23:10+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "10.32-3.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2022-4899",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        400
      ],
      "description": "A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2022-4899"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:1141"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-4899"
        },
        {
          "url": "https://bugzilla.redhat.com/2179864"
        },
        {
          "url": "https://bugzilla.redhat.com/2188109"
        },
        {
          "url": "https://bugzilla.redhat.com/2188113"
        },
        {
          "url": "https://bugzilla.redhat.com/2188115"
        },
        {
          "url": "https://bugzilla.redhat.com/2188116"
        },
        {
          "url": "https://bugzilla.redhat.com/2188117"
        },
        {
          "url": "https://bugzilla.redhat.com/2188118"
        },
        {
          "url": "https://bugzilla.redhat.com/2188119"
        },
        {
          "url": "https://bugzilla.redhat.com/2188120"
        },
        {
          "url": "https://bugzilla.redhat.com/2188121"
        },
        {
          "url": "https://bugzilla.redhat.com/2188122"
        },
        {
          "url": "https://bugzilla.redhat.com/2188123"
        },
        {
          "url": "https://bugzilla.redhat.com/2188124"
        },
        {
          "url": "https://bugzilla.redhat.com/2188125"
        },
        {
          "url": "https://bugzilla.redhat.com/2188127"
        },
        {
          "url": "https://bugzilla.redhat.com/2188128"
        },
        {
          "url": "https://bugzilla.redhat.com/2188129"
        },
        {
          "url": "https://bugzilla.redhat.com/2188130"
        },
        {
          "url": "https://bugzilla.redhat.com/2188131"
        },
        {
          "url": "https://bugzilla.redhat.com/2188132"
        },
        {
          "url": "https://bugzilla.redhat.com/2224211"
        },
        {
          "url": "https://bugzilla.redhat.com/2224212"
        },
        {
          "url": "https://bugzilla.redhat.com/2224213"
        },
        {
          "url": "https://bugzilla.redhat.com/2224214"
        },
        {
          "url": "https://bugzilla.redhat.com/2224215"
        },
        {
          "url": "https://bugzilla.redhat.com/2224216"
        },
        {
          "url": "https://bugzilla.redhat.com/2224217"
        },
        {
          "url": "https://bugzilla.redhat.com/2224218"
        },
        {
          "url": "https://bugzilla.redhat.com/2224219"
        },
        {
          "url": "https://bugzilla.redhat.com/2224220"
        },
        {
          "url": "https://bugzilla.redhat.com/2224221"
        },
        {
          "url": "https://bugzilla.redhat.com/2224222"
        },
        {
          "url": "https://bugzilla.redhat.com/2245014"
        },
        {
          "url": "https://bugzilla.redhat.com/2245015"
        },
        {
          "url": "https://bugzilla.redhat.com/2245016"
        },
        {
          "url": "https://bugzilla.redhat.com/2245017"
        },
        {
          "url": "https://bugzilla.redhat.com/2245018"
        },
        {
          "url": "https://bugzilla.redhat.com/2245019"
        },
        {
          "url": "https://bugzilla.redhat.com/2245020"
        },
        {
          "url": "https://bugzilla.redhat.com/2245021"
        },
        {
          "url": "https://bugzilla.redhat.com/2245022"
        },
        {
          "url": "https://bugzilla.redhat.com/2245023"
        },
        {
          "url": "https://bugzilla.redhat.com/2245024"
        },
        {
          "url": "https://bugzilla.redhat.com/2245026"
        },
        {
          "url": "https://bugzilla.redhat.com/2245027"
        },
        {
          "url": "https://bugzilla.redhat.com/2245028"
        },
        {
          "url": "https://bugzilla.redhat.com/2245029"
        },
        {
          "url": "https://bugzilla.redhat.com/2245030"
        },
        {
          "url": "https://bugzilla.redhat.com/2245031"
        },
        {
          "url": "https://bugzilla.redhat.com/2245032"
        },
        {
          "url": "https://bugzilla.redhat.com/2245033"
        },
        {
          "url": "https://bugzilla.redhat.com/2245034"
        },
        {
          "url": "https://bugzilla.redhat.com/2258771"
        },
        {
          "url": "https://bugzilla.redhat.com/2258772"
        },
        {
          "url": "https://bugzilla.redhat.com/2258773"
        },
        {
          "url": "https://bugzilla.redhat.com/2258774"
        },
        {
          "url": "https://bugzilla.redhat.com/2258775"
        },
        {
          "url": "https://bugzilla.redhat.com/2258776"
        },
        {
          "url": "https://bugzilla.redhat.com/2258777"
        },
        {
          "url": "https://bugzilla.redhat.com/2258778"
        },
        {
          "url": "https://bugzilla.redhat.com/2258779"
        },
        {
          "url": "https://bugzilla.redhat.com/2258780"
        },
        {
          "url": "https://bugzilla.redhat.com/2258781"
        },
        {
          "url": "https://bugzilla.redhat.com/2258782"
        },
        {
          "url": "https://bugzilla.redhat.com/2258783"
        },
        {
          "url": "https://bugzilla.redhat.com/2258784"
        },
        {
          "url": "https://bugzilla.redhat.com/2258785"
        },
        {
          "url": "https://bugzilla.redhat.com/2258787"
        },
        {
          "url": "https://bugzilla.redhat.com/2258788"
        },
        {
          "url": "https://bugzilla.redhat.com/2258789"
        },
        {
          "url": "https://bugzilla.redhat.com/2258790"
        },
        {
          "url": "https://bugzilla.redhat.com/2258791"
        },
        {
          "url": "https://bugzilla.redhat.com/2258792"
        },
        {
          "url": "https://bugzilla.redhat.com/2258793"
        },
        {
          "url": "https://bugzilla.redhat.com/2258794"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179864"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188109"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188113"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188115"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188116"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188117"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188118"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188119"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188120"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188122"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188123"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188124"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188125"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188127"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188128"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188129"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188130"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188131"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188132"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224211"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224212"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224213"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224214"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224215"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224216"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224217"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224218"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224219"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224220"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224221"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224222"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245014"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245015"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245016"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245017"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245018"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245019"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245020"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245021"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245022"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245023"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245024"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245026"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245027"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245028"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245029"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245030"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245031"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245032"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245033"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245034"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258771"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258772"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258773"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258774"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258775"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258776"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258777"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258778"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258779"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258780"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258781"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258782"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258783"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258784"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258785"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258787"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258788"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258789"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258790"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258791"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258792"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258793"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258794"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4899"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21911"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21919"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21920"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21929"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21933"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21935"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21940"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21945"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21946"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21947"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21953"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21955"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21962"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21972"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21976"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21977"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21980"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22005"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22007"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22008"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22032"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22033"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22038"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22046"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22048"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22053"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22054"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22056"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22057"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22058"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22059"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22064"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22065"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22066"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22068"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22070"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22078"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22079"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22084"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22092"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22097"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22103"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22104"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22110"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22111"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22112"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22113"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22114"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22115"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20960"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20961"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20962"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20963"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20968"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20969"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20970"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20971"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20972"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20973"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20974"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20976"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20977"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20978"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20981"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20983"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20984"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20985"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20993"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21050"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21051"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21052"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21053"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21055"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21056"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21057"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21061"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21137"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21200"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-1141.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2024:0894"
        },
        {
          "url": "https://github.com/facebook/zstd"
        },
        {
          "url": "https://github.com/facebook/zstd/issues/3200"
        },
        {
          "url": "https://github.com/facebook/zstd/pull/3220"
        },
        {
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/zstd/PYSEC-2023-121.yaml"
        },
        {
          "url": "https://github.com/sergey-dryabzhinsky/python-zstd/commit/c8a619aebdbd6b838fbfef6e19325a70f631a4c6"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2022-4899.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-1141.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4899"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230725-0005"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230725-0005/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4899"
        }
      ],
      "published": "2023-03-31T20:15:07+00:00",
      "updated": "2025-02-18T18:15:14+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.4.4-1.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2023-0464",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        295
      ],
      "description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-0464"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2023:3722"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-0464"
        },
        {
          "url": "https://bugzilla.redhat.com/2181082"
        },
        {
          "url": "https://bugzilla.redhat.com/2182561"
        },
        {
          "url": "https://bugzilla.redhat.com/2182565"
        },
        {
          "url": "https://bugzilla.redhat.com/2188461"
        },
        {
          "url": "https://bugzilla.redhat.com/2207947"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1"
        },
        {
          "url": "https://github.com/advisories/GHSA-w2w6-xp88-5cvw"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-0464.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0464"
        },
        {
          "url": "https://security.gentoo.org/glsa/202402-08"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230406-0006"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230406-0006/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6039-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.couchbase.com/alerts"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5417"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20230322.txt"
        }
      ],
      "published": "2023-03-22T17:15:13+00:00",
      "updated": "2025-05-05T16:15:26+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2023-0465",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        295
      ],
      "description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-0465"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2023:3722"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-0465"
        },
        {
          "url": "https://bugzilla.redhat.com/2181082"
        },
        {
          "url": "https://bugzilla.redhat.com/2182561"
        },
        {
          "url": "https://bugzilla.redhat.com/2182565"
        },
        {
          "url": "https://bugzilla.redhat.com/2188461"
        },
        {
          "url": "https://bugzilla.redhat.com/2207947"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c"
        },
        {
          "url": "https://github.com/advisories/GHSA-77f3-6546-6rj7"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-0465.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0465"
        },
        {
          "url": "https://security.gentoo.org/glsa/202402-08"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230414-0001"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230414-0001/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6039-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0465"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5417"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20230328.txt"
        }
      ],
      "published": "2023-03-28T15:15:06+00:00",
      "updated": "2025-02-18T21:15:13+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2023-0466",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        295
      ],
      "description": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-0466"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/09/28/4"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2023:3722"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-0466"
        },
        {
          "url": "https://bugzilla.redhat.com/2181082"
        },
        {
          "url": "https://bugzilla.redhat.com/2182561"
        },
        {
          "url": "https://bugzilla.redhat.com/2182565"
        },
        {
          "url": "https://bugzilla.redhat.com/2188461"
        },
        {
          "url": "https://bugzilla.redhat.com/2207947"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061"
        },
        {
          "url": "https://github.com/advisories/GHSA-pxvj-4wx4-gv6w"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-0466.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0466"
        },
        {
          "url": "https://security.gentoo.org/glsa/202402-08"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230414-0001"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230414-0001/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6039-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0466"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5417"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20230328.txt"
        }
      ],
      "published": "2023-03-28T15:15:06+00:00",
      "updated": "2025-02-19T18:15:22+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2023-2650",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        770
      ],
      "description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-2650"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/05/30/1"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2023:6330"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-2650"
        },
        {
          "url": "https://bugzilla.redhat.com/1858038"
        },
        {
          "url": "https://bugzilla.redhat.com/2207947"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2023-6330.html"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a"
        },
        {
          "url": "https://github.com/advisories/GHSA-gqxg-9vfr-p9cg"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-2650.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2023-6330.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2650"
        },
        {
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009"
        },
        {
          "url": "https://security.gentoo.org/glsa/202402-08"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230703-0001/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231027-0009/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6119-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6188-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6672-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5417"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20230530.txt"
        }
      ],
      "published": "2023-05-30T14:15:09+00:00",
      "updated": "2025-03-19T16:15:21+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2023-27534",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 8.8,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        22
      ],
      "description": "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-27534"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2023:6679"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-27534"
        },
        {
          "url": "https://bugzilla.redhat.com/2179062"
        },
        {
          "url": "https://bugzilla.redhat.com/2179069"
        },
        {
          "url": "https://bugzilla.redhat.com/2179092"
        },
        {
          "url": "https://bugzilla.redhat.com/2179103"
        },
        {
          "url": "https://curl.se/docs/CVE-2023-27534.html"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2023-6679.html"
        },
        {
          "url": "https://hackerone.com/reports/1892351"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-27534.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2023-6679.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27534"
        },
        {
          "url": "https://security.gentoo.org/glsa/202310-12"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230420-0012/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-5964-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-27534"
        }
      ],
      "published": "2023-03-30T20:15:07+00:00",
      "updated": "2025-04-23T17:16:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2023-29499",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.2,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        400
      ],
      "description": "A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-29499"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:2528"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-29499"
        },
        {
          "url": "https://bugzilla.redhat.com/2211827"
        },
        {
          "url": "https://bugzilla.redhat.com/2211828"
        },
        {
          "url": "https://bugzilla.redhat.com/2211829"
        },
        {
          "url": "https://bugzilla.redhat.com/2211833"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211828"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2794"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-29499.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29499"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-18"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231103-0001/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-29499"
        }
      ],
      "published": "2023-09-14T20:15:09+00:00",
      "updated": "2024-11-21T07:57:10+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2023-32611",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        400
      ],
      "description": "A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-32611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:2528"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-32611"
        },
        {
          "url": "https://bugzilla.redhat.com/2211827"
        },
        {
          "url": "https://bugzilla.redhat.com/2211828"
        },
        {
          "url": "https://bugzilla.redhat.com/2211829"
        },
        {
          "url": "https://bugzilla.redhat.com/2211833"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211829"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2797"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-32611.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32611"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-18"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231027-0005/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-32611"
        }
      ],
      "published": "2023-09-14T20:15:09+00:00",
      "updated": "2024-11-21T08:03:41+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2023-32636",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.2,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        400,
        502
      ],
      "description": "A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-32636"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:2528"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-32636"
        },
        {
          "url": "https://bugzilla.redhat.com/2211827"
        },
        {
          "url": "https://bugzilla.redhat.com/2211828"
        },
        {
          "url": "https://bugzilla.redhat.com/2211829"
        },
        {
          "url": "https://bugzilla.redhat.com/2211833"
        },
        {
          "url": "https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2841"
        },
        {
          "url": "https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-32636.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32636"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231110-0002/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-32636"
        }
      ],
      "published": "2023-09-14T20:15:09+00:00",
      "updated": "2024-11-21T08:03:44+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2023-32665",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        400,
        502
      ],
      "description": "A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-32665"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:2528"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-32665"
        },
        {
          "url": "https://bugzilla.redhat.com/2211827"
        },
        {
          "url": "https://bugzilla.redhat.com/2211828"
        },
        {
          "url": "https://bugzilla.redhat.com/2211829"
        },
        {
          "url": "https://bugzilla.redhat.com/2211833"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211827"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2121"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-32665.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32665"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-18"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240426-0006/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6165-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-32665"
        }
      ],
      "published": "2023-09-14T20:15:09+00:00",
      "updated": "2024-11-21T08:03:48+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2023-39804",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "description": "In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-39804"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-39804"
        },
        {
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079"
        },
        {
          "url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4"
        },
        {
          "url": "https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39804"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6543-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-39804"
        }
      ],
      "published": "2024-03-27T04:15:08+00:00",
      "updated": "2025-11-04T19:15:55+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2023-4156",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.1,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        125
      ],
      "description": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-4156"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-4156"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215930"
        },
        {
          "url": "https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212"
        },
        {
          "url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00000.html"
        },
        {
          "url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00023.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4156"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6373-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-4156"
        }
      ],
      "published": "2023-09-25T18:15:11+00:00",
      "updated": "2024-11-21T08:34:30+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.2.1-4.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2023-45322",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        416
      ],
      "description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-45322"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/10/06/5"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-45322"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/344"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/583"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45322"
        }
      ],
      "published": "2023-10-06T22:15:11+00:00",
      "updated": "2025-11-03T21:16:01+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2023-45803",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 4.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        200
      ],
      "description": "urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-45803"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:2132"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-45803"
        },
        {
          "url": "https://bugzilla.redhat.com/2246840"
        },
        {
          "url": "https://bugzilla.redhat.com/2257028"
        },
        {
          "url": "https://bugzilla.redhat.com/2257854"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246840"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45803"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-2132.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2024:11238"
        },
        {
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml"
        },
        {
          "url": "https://github.com/urllib3/urllib3"
        },
        {
          "url": "https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3"
        },
        {
          "url": "https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9"
        },
        {
          "url": "https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36"
        },
        {
          "url": "https://github.com/urllib3/urllib3/releases/tag/1.26.18"
        },
        {
          "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
        },
        {
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2023-45803.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-2988.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6473-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6473-2"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7762-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
        },
        {
          "url": "https://www.rfc-editor.org/rfc/rfc9110.html#name-get"
        }
      ],
      "published": "2023-10-17T20:15:10+00:00",
      "updated": "2025-11-03T22:16:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        }
      ]
    },
    {
      "id": "CVE-2023-50495",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2023-50495"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2023-50495"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"
        },
        {
          "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html"
        },
        {
          "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50495"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240119-0008/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6684-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-50495"
        }
      ],
      "published": "2023-12-12T15:15:07+00:00",
      "updated": "2025-11-04T19:16:14+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "6.1-10.20180224.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2024-0232",
      "ratings": [
        {
          "source": {
            "name": "bitnami"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        416
      ],
      "description": "A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-0232"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-0232"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243754"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0232"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240315-0007/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-0232"
        }
      ],
      "published": "2024-01-16T14:15:48+00:00",
      "updated": "2024-11-21T08:46:06+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.26.0-20.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2024-0397",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "bitnami"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        362
      ],
      "description": "A defect was discovered in the Python \u201cssl\u201d module where there is a memory\nrace condition with the ssl.SSLContext methods \u201ccert_store_stats()\u201d and\n\u201cget_ca_certs()\u201d. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-0397"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/17/2"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-0397"
        },
        {
          "url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"
        },
        {
          "url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"
        },
        {
          "url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"
        },
        {
          "url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"
        },
        {
          "url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"
        },
        {
          "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
        },
        {
          "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
        },
        {
          "url": "https://github.com/python/cpython/issues/114572"
        },
        {
          "url": "https://github.com/python/cpython/pull/114573"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0397"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250411-0006/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6928-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-0397"
        }
      ],
      "published": "2024-06-17T16:15:10+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
          "versions": [
            {
              "version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        }
      ]
    },
    {
      "id": "CVE-2024-0727",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-0727"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:9088"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-0727"
        },
        {
          "url": "https://bugzilla.redhat.com/2257571"
        },
        {
          "url": "https://bugzilla.redhat.com/2258502"
        },
        {
          "url": "https://bugzilla.redhat.com/2259944"
        },
        {
          "url": "https://bugzilla.redhat.com/2284243"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2257571"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258502"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259944"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284243"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6129"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6237"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0727"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1298"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-9088.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2024:9088"
        },
        {
          "url": "https://github.com/advisories/GHSA-9v9h-cgj8-h64p"
        },
        {
          "url": "https://github.com/alexcrichton/openssl-src-rs/commit/add20f73b6b42be7451af2e1044d4e0e778992b2"
        },
        {
          "url": "https://github.com/github/advisory-database/pull/3472"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c"
        },
        {
          "url": "https://github.com/openssl/openssl/pull/23362"
        },
        {
          "url": "https://github.com/pyca/cryptography/commit/3519591d255d4506fbcd0d04037d45271903c64d"
        },
        {
          "url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8"
        },
        {
          "url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-0727.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-9088.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240208-0006"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240208-0006/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6622-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6632-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6709-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7018-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20240125.txt"
        }
      ],
      "published": "2024-01-26T09:15:07+00:00",
      "updated": "2026-05-12T12:16:16+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any Python code. That assures that the vulnerable code path in the affected library is not reachable. The Python libraries are only used for diagnostics."
      }
    },
    {
      "id": "CVE-2024-10524",
      "ratings": [
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
        }
      ],
      "cwes": [
        918
      ],
      "description": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-10524"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/11/18/6"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-10524"
        },
        {
          "url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778"
        },
        {
          "url": "https://github.com/advisories/GHSA-mqrm-h2pw-9j9r"
        },
        {
          "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability"
        },
        {
          "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10524"
        },
        {
          "url": "https://seclists.org/oss-sec/2024/q4/107"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250321-0007"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250321-0007/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-10524"
        }
      ],
      "published": "2024-11-19T15:15:06+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.19.5-12.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2024-11053",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 3.4,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-11053"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/12/11/1"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:1671"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-11053"
        },
        {
          "url": "https://bugzilla.redhat.com/2294581"
        },
        {
          "url": "https://bugzilla.redhat.com/2294676"
        },
        {
          "url": "https://bugzilla.redhat.com/2301888"
        },
        {
          "url": "https://bugzilla.redhat.com/2318857"
        },
        {
          "url": "https://bugzilla.redhat.com/2318858"
        },
        {
          "url": "https://bugzilla.redhat.com/2318870"
        },
        {
          "url": "https://bugzilla.redhat.com/2318873"
        },
        {
          "url": "https://bugzilla.redhat.com/2318874"
        },
        {
          "url": "https://bugzilla.redhat.com/2318876"
        },
        {
          "url": "https://bugzilla.redhat.com/2318882"
        },
        {
          "url": "https://bugzilla.redhat.com/2318883"
        },
        {
          "url": "https://bugzilla.redhat.com/2318884"
        },
        {
          "url": "https://bugzilla.redhat.com/2318885"
        },
        {
          "url": "https://bugzilla.redhat.com/2318886"
        },
        {
          "url": "https://bugzilla.redhat.com/2318897"
        },
        {
          "url": "https://bugzilla.redhat.com/2318900"
        },
        {
          "url": "https://bugzilla.redhat.com/2318905"
        },
        {
          "url": "https://bugzilla.redhat.com/2318914"
        },
        {
          "url": "https://bugzilla.redhat.com/2318922"
        },
        {
          "url": "https://bugzilla.redhat.com/2318923"
        },
        {
          "url": "https://bugzilla.redhat.com/2318925"
        },
        {
          "url": "https://bugzilla.redhat.com/2318926"
        },
        {
          "url": "https://bugzilla.redhat.com/2318927"
        },
        {
          "url": "https://bugzilla.redhat.com/2331191"
        },
        {
          "url": "https://bugzilla.redhat.com/2339218"
        },
        {
          "url": "https://bugzilla.redhat.com/2339220"
        },
        {
          "url": "https://bugzilla.redhat.com/2339221"
        },
        {
          "url": "https://bugzilla.redhat.com/2339226"
        },
        {
          "url": "https://bugzilla.redhat.com/2339231"
        },
        {
          "url": "https://bugzilla.redhat.com/2339236"
        },
        {
          "url": "https://bugzilla.redhat.com/2339238"
        },
        {
          "url": "https://bugzilla.redhat.com/2339243"
        },
        {
          "url": "https://bugzilla.redhat.com/2339247"
        },
        {
          "url": "https://bugzilla.redhat.com/2339252"
        },
        {
          "url": "https://bugzilla.redhat.com/2339259"
        },
        {
          "url": "https://bugzilla.redhat.com/2339266"
        },
        {
          "url": "https://bugzilla.redhat.com/2339270"
        },
        {
          "url": "https://bugzilla.redhat.com/2339271"
        },
        {
          "url": "https://bugzilla.redhat.com/2339275"
        },
        {
          "url": "https://bugzilla.redhat.com/2339277"
        },
        {
          "url": "https://bugzilla.redhat.com/2339281"
        },
        {
          "url": "https://bugzilla.redhat.com/2339284"
        },
        {
          "url": "https://bugzilla.redhat.com/2339291"
        },
        {
          "url": "https://bugzilla.redhat.com/2339293"
        },
        {
          "url": "https://bugzilla.redhat.com/2339295"
        },
        {
          "url": "https://bugzilla.redhat.com/2339299"
        },
        {
          "url": "https://bugzilla.redhat.com/2339300"
        },
        {
          "url": "https://bugzilla.redhat.com/2339304"
        },
        {
          "url": "https://bugzilla.redhat.com/2339305"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305"
        },
        {
          "url": "https://curl.se/docs/CVE-2024-11053.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2024-11053.json"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-1671.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:1671"
        },
        {
          "url": "https://github.com/advisories/GHSA-h288-5fq8-5pfw"
        },
        {
          "url": "https://hackerone.com/reports/2829063"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-11053.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-1673.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11053"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250124-0012"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250124-0012/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250131-0003"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250131-0003/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250131-0004"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250131-0004/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7162-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-11053"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL"
        }
      ],
      "published": "2024-12-11T08:15:05+00:00",
      "updated": "2025-11-03T21:16:04+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ]
    },
    {
      "id": "CVE-2024-13176",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 4.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        385
      ],
      "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-13176"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/01/20/2"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:16046"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-13176"
        },
        {
          "url": "https://bugzilla.redhat.com/2359885"
        },
        {
          "url": "https://bugzilla.redhat.com/2359888"
        },
        {
          "url": "https://bugzilla.redhat.com/2359892"
        },
        {
          "url": "https://bugzilla.redhat.com/2359894"
        },
        {
          "url": "https://bugzilla.redhat.com/2359895"
        },
        {
          "url": "https://bugzilla.redhat.com/2359899"
        },
        {
          "url": "https://bugzilla.redhat.com/2359900"
        },
        {
          "url": "https://bugzilla.redhat.com/2359902"
        },
        {
          "url": "https://bugzilla.redhat.com/2359903"
        },
        {
          "url": "https://bugzilla.redhat.com/2359911"
        },
        {
          "url": "https://bugzilla.redhat.com/2359918"
        },
        {
          "url": "https://bugzilla.redhat.com/2359920"
        },
        {
          "url": "https://bugzilla.redhat.com/2359924"
        },
        {
          "url": "https://bugzilla.redhat.com/2359928"
        },
        {
          "url": "https://bugzilla.redhat.com/2359930"
        },
        {
          "url": "https://bugzilla.redhat.com/2359932"
        },
        {
          "url": "https://bugzilla.redhat.com/2359934"
        },
        {
          "url": "https://bugzilla.redhat.com/2359938"
        },
        {
          "url": "https://bugzilla.redhat.com/2359940"
        },
        {
          "url": "https://bugzilla.redhat.com/2359943"
        },
        {
          "url": "https://bugzilla.redhat.com/2359944"
        },
        {
          "url": "https://bugzilla.redhat.com/2359945"
        },
        {
          "url": "https://bugzilla.redhat.com/2359947"
        },
        {
          "url": "https://bugzilla.redhat.com/2359950"
        },
        {
          "url": "https://bugzilla.redhat.com/2359963"
        },
        {
          "url": "https://bugzilla.redhat.com/2359964"
        },
        {
          "url": "https://bugzilla.redhat.com/2359972"
        },
        {
          "url": "https://bugzilla.redhat.com/2370920"
        },
        {
          "url": "https://bugzilla.redhat.com/2380264"
        },
        {
          "url": "https://bugzilla.redhat.com/2380273"
        },
        {
          "url": "https://bugzilla.redhat.com/2380274"
        },
        {
          "url": "https://bugzilla.redhat.com/2380278"
        },
        {
          "url": "https://bugzilla.redhat.com/2380280"
        },
        {
          "url": "https://bugzilla.redhat.com/2380283"
        },
        {
          "url": "https://bugzilla.redhat.com/2380284"
        },
        {
          "url": "https://bugzilla.redhat.com/2380290"
        },
        {
          "url": "https://bugzilla.redhat.com/2380291"
        },
        {
          "url": "https://bugzilla.redhat.com/2380295"
        },
        {
          "url": "https://bugzilla.redhat.com/2380298"
        },
        {
          "url": "https://bugzilla.redhat.com/2380306"
        },
        {
          "url": "https://bugzilla.redhat.com/2380308"
        },
        {
          "url": "https://bugzilla.redhat.com/2380309"
        },
        {
          "url": "https://bugzilla.redhat.com/2380310"
        },
        {
          "url": "https://bugzilla.redhat.com/2380312"
        },
        {
          "url": "https://bugzilla.redhat.com/2380313"
        },
        {
          "url": "https://bugzilla.redhat.com/2380320"
        },
        {
          "url": "https://bugzilla.redhat.com/2380321"
        },
        {
          "url": "https://bugzilla.redhat.com/2380322"
        },
        {
          "url": "https://bugzilla.redhat.com/2380326"
        },
        {
          "url": "https://bugzilla.redhat.com/2380327"
        },
        {
          "url": "https://bugzilla.redhat.com/2380334"
        },
        {
          "url": "https://bugzilla.redhat.com/2380335"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338999"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359885"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359888"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359892"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359894"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359895"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359899"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359900"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359902"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359903"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359911"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359918"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359920"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359924"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359928"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359930"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359934"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359938"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359940"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359943"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359944"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359945"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359947"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359950"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359963"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359964"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359972"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370920"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380264"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380273"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380274"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380278"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380280"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380283"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380284"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380290"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380291"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380295"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380298"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380306"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380308"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380309"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380310"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380312"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380313"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380320"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380321"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380322"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380326"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380327"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380334"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380335"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-16046.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:15699"
        },
        {
          "url": "https://github.com/advisories/GHSA-r9fv-h47r-823f"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f"
        },
        {
          "url": "https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded"
        },
        {
          "url": "https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-13176.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-16046.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13176"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20250120.txt"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250124-0005"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250124-0005/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250418-0010"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250418-0010/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250502-0006"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250502-0006/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7264-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7278-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-13176"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL"
        }
      ],
      "published": "2025-01-20T14:15:26+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ]
    },
    {
      "id": "CVE-2024-2236",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        385
      ],
      "description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-2236"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:9404"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:3530"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:3534"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-2236"
        },
        {
          "url": "https://bugzilla.redhat.com/2245218"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245218"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268268"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2236"
        },
        {
          "url": "https://dev.gnupg.org/T7136"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-9404.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2024:9404"
        },
        {
          "url": "https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt"
        },
        {
          "url": "https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-2236.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-9404.html"
        },
        {
          "url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2236"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-2236"
        }
      ],
      "published": "2024-03-06T22:15:57+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.8.5-7.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2024-2511",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        1325
      ],
      "description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-2511"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/08/5"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:9333"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-2511"
        },
        {
          "url": "https://bugzilla.redhat.com/2274020"
        },
        {
          "url": "https://bugzilla.redhat.com/2281029"
        },
        {
          "url": "https://bugzilla.redhat.com/2283757"
        },
        {
          "url": "https://bugzilla.redhat.com/2294581"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274020"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281029"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283757"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-354112.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2511"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4603"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4741"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-9333.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2024:9333"
        },
        {
          "url": "https://github.com/advisories/GHSA-299c-jvhc-gxj8"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08"
        },
        {
          "url": "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-2511.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-9333.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2511"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240503-0013"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240503-0013/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6937-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20240408.txt"
        },
        {
          "url": "https://www.openssl.org/news/vulnerabilities.html"
        }
      ],
      "published": "2024-04-08T14:15:07+00:00",
      "updated": "2026-05-12T12:16:33+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2024-25260",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-25260"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-25260"
        },
        {
          "url": "https://github.com/schsiung/fuzzer_issues/issues/1"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25260"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31058"
        },
        {
          "url": "https://sourceware.org/elfutils/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7369-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-25260"
        }
      ],
      "published": "2024-02-20T18:15:52+00:00",
      "updated": "2025-04-25T20:42:23+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.190-2.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.190-2.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.190-2.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2024-33655",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        400
      ],
      "description": "The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-33655"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18931"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-33655"
        },
        {
          "url": "https://alas.aws.amazon.com/ALAS-2024-1934.html"
        },
        {
          "url": "https://bugzilla.redhat.com/2279942"
        },
        {
          "url": "https://bugzilla.redhat.com/2405706"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279942"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405706"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33655"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11411"
        },
        {
          "url": "https://datatracker.ietf.org/doc/html/rfc1035"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18931.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18556"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de"
        },
        {
          "url": "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120"
        },
        {
          "url": "https://gitlab.isc.org/isc-projects/bind9/-/issues/4398"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00019.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"
        },
        {
          "url": "https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/"
        },
        {
          "url": "https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt"
        },
        {
          "url": "https://nlnetlabs.nl/projects/unbound/security-advisories/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33655"
        },
        {
          "url": "https://sp2024.ieee-security.org/accepted-papers.html"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6791-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-33655"
        },
        {
          "url": "https://www.isc.org/blogs/2024-dnsbomb/"
        },
        {
          "url": "https://www.nlnetlabs.nl/news/2024/May/08/unbound-1.20.0-released/"
        }
      ],
      "published": "2024-06-06T17:15:51+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2024-34459",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        122
      ],
      "description": "An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-34459"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-34459"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7240-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7302-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-34459"
        }
      ],
      "published": "2024-05-14T15:39:11+00:00",
      "updated": "2025-11-04T22:16:01+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
      }
    },
    {
      "id": "CVE-2024-41996",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        295
      ],
      "description": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-41996"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-41996"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
        },
        {
          "url": "https://dheatattack.gitlab.io/details/"
        },
        {
          "url": "https://dheatattack.gitlab.io/faq/"
        },
        {
          "url": "https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1"
        },
        {
          "url": "https://github.com/openssl/openssl/issues/17374"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41996"
        },
        {
          "url": "https://openssl-library.org/post/2022-10-21-tls-groups-configuration/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-41996"
        }
      ],
      "published": "2024-08-26T06:15:04+00:00",
      "updated": "2026-05-12T12:17:03+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent                  Platform does not invoke any binaries present in the container. That                 assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2024-43167",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        476
      ],
      "description": "DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-43167"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/08/16/6"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-43167"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303456"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/issues/1072"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/pull/1073"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/pull/1073/files"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43167"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6998-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-43167"
        }
      ],
      "published": "2024-08-12T13:38:35+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2024-43168",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        122
      ],
      "description": "DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-43168"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-43168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303462"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/issues/1039"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/pull/1040"
        },
        {
          "url": "https://github.com/NLnetLabs/unbound/pull/1040/files"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43168"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6998-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-43168"
        }
      ],
      "published": "2024-08-12T13:38:36+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2024-4741",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.6,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        416
      ],
      "description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-4741"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2024:9333"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-4741"
        },
        {
          "url": "https://bugzilla.redhat.com/2274020"
        },
        {
          "url": "https://bugzilla.redhat.com/2281029"
        },
        {
          "url": "https://bugzilla.redhat.com/2283757"
        },
        {
          "url": "https://bugzilla.redhat.com/2294581"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274020"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281029"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283757"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2511"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4603"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4741"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2024-9333.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2024:9333"
        },
        {
          "url": "https://github.com/advisories/GHSA-6vgq-8qjq-h578"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8"
        },
        {
          "url": "https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-4741.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2024-9333.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4741"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0004"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0004/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6937-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7894-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20240528.txt"
        }
      ],
      "published": "2024-11-13T11:15:04+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
      }
    },
    {
      "id": "CVE-2024-56433",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.6,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        1188
      ],
      "description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-56433"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:20559"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-56433"
        },
        {
          "url": "https://bugzilla.redhat.com/2334165"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334165"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56433"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-20559.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:20145"
        },
        {
          "url": "https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241"
        },
        {
          "url": "https://github.com/shadow-maint/shadow/issues/1157"
        },
        {
          "url": "https://github.com/shadow-maint/shadow/releases/tag/4.4"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-56433.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-20559-0.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56433"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-56433"
        }
      ],
      "published": "2024-12-26T09:15:07+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:4.6-23.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2024-57970",
      "ratings": [
        {
          "source": {
            "name": "julia"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        126
      ],
      "description": "libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-57970"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-57970"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345954"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57970"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:7510"
        },
        {
          "url": "https://github.com/advisories/GHSA-2q66-6w43-8rm9"
        },
        {
          "url": "https://github.com/libarchive/libarchive/issues/2415"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2422"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-57970.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-7510.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57970"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-57970"
        }
      ],
      "published": "2025-02-16T04:15:21+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2024-7264",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        125
      ],
      "description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-7264"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/07/31/1"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:1671"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-7264"
        },
        {
          "url": "https://bugzilla.redhat.com/2294581"
        },
        {
          "url": "https://bugzilla.redhat.com/2294676"
        },
        {
          "url": "https://bugzilla.redhat.com/2301888"
        },
        {
          "url": "https://bugzilla.redhat.com/2318857"
        },
        {
          "url": "https://bugzilla.redhat.com/2318858"
        },
        {
          "url": "https://bugzilla.redhat.com/2318870"
        },
        {
          "url": "https://bugzilla.redhat.com/2318873"
        },
        {
          "url": "https://bugzilla.redhat.com/2318874"
        },
        {
          "url": "https://bugzilla.redhat.com/2318876"
        },
        {
          "url": "https://bugzilla.redhat.com/2318882"
        },
        {
          "url": "https://bugzilla.redhat.com/2318883"
        },
        {
          "url": "https://bugzilla.redhat.com/2318884"
        },
        {
          "url": "https://bugzilla.redhat.com/2318885"
        },
        {
          "url": "https://bugzilla.redhat.com/2318886"
        },
        {
          "url": "https://bugzilla.redhat.com/2318897"
        },
        {
          "url": "https://bugzilla.redhat.com/2318900"
        },
        {
          "url": "https://bugzilla.redhat.com/2318905"
        },
        {
          "url": "https://bugzilla.redhat.com/2318914"
        },
        {
          "url": "https://bugzilla.redhat.com/2318922"
        },
        {
          "url": "https://bugzilla.redhat.com/2318923"
        },
        {
          "url": "https://bugzilla.redhat.com/2318925"
        },
        {
          "url": "https://bugzilla.redhat.com/2318926"
        },
        {
          "url": "https://bugzilla.redhat.com/2318927"
        },
        {
          "url": "https://bugzilla.redhat.com/2331191"
        },
        {
          "url": "https://bugzilla.redhat.com/2339218"
        },
        {
          "url": "https://bugzilla.redhat.com/2339220"
        },
        {
          "url": "https://bugzilla.redhat.com/2339221"
        },
        {
          "url": "https://bugzilla.redhat.com/2339226"
        },
        {
          "url": "https://bugzilla.redhat.com/2339231"
        },
        {
          "url": "https://bugzilla.redhat.com/2339236"
        },
        {
          "url": "https://bugzilla.redhat.com/2339238"
        },
        {
          "url": "https://bugzilla.redhat.com/2339243"
        },
        {
          "url": "https://bugzilla.redhat.com/2339247"
        },
        {
          "url": "https://bugzilla.redhat.com/2339252"
        },
        {
          "url": "https://bugzilla.redhat.com/2339259"
        },
        {
          "url": "https://bugzilla.redhat.com/2339266"
        },
        {
          "url": "https://bugzilla.redhat.com/2339270"
        },
        {
          "url": "https://bugzilla.redhat.com/2339271"
        },
        {
          "url": "https://bugzilla.redhat.com/2339275"
        },
        {
          "url": "https://bugzilla.redhat.com/2339277"
        },
        {
          "url": "https://bugzilla.redhat.com/2339281"
        },
        {
          "url": "https://bugzilla.redhat.com/2339284"
        },
        {
          "url": "https://bugzilla.redhat.com/2339291"
        },
        {
          "url": "https://bugzilla.redhat.com/2339293"
        },
        {
          "url": "https://bugzilla.redhat.com/2339295"
        },
        {
          "url": "https://bugzilla.redhat.com/2339299"
        },
        {
          "url": "https://bugzilla.redhat.com/2339300"
        },
        {
          "url": "https://bugzilla.redhat.com/2339304"
        },
        {
          "url": "https://bugzilla.redhat.com/2339305"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305"
        },
        {
          "url": "https://curl.se/docs/CVE-2024-7264.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2024-7264.json"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-1671.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:1671"
        },
        {
          "url": "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519"
        },
        {
          "url": "https://hackerone.com/reports/2629968"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-7264.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-1673.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240828-0008/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20241025-0010/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6944-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-6944-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7264"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL"
        }
      ],
      "published": "2024-07-31T08:15:02+00:00",
      "updated": "2025-11-03T23:17:31+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2024-7592",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "bitnami"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        400,
        1333
      ],
      "description": "There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-7592"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:3634"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-7592"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305879"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7592"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-3634.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:3634"
        },
        {
          "url": "https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621"
        },
        {
          "url": "https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef"
        },
        {
          "url": "https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06"
        },
        {
          "url": "https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a"
        },
        {
          "url": "https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f"
        },
        {
          "url": "https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774"
        },
        {
          "url": "https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1"
        },
        {
          "url": "https://github.com/python/cpython/issues/123067"
        },
        {
          "url": "https://github.com/python/cpython/pull/123075"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2024-7592.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-3634.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20241018-0006/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7015-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7015-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7592"
        }
      ],
      "published": "2024-08-19T19:15:08+00:00",
      "updated": "2025-11-03T23:17:31+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
          "versions": [
            {
              "version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Temurin JVM binary is not linked against freetype library:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\nlinux-vdso.so.1 (0x0000ffff8cd00000)\nlibjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\nlibpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\nlibdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\nlibc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n/lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-11411",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        349
      ],
      "description": "NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-11411"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/11/26/4"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18931"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-11411"
        },
        {
          "url": "https://bugzilla.redhat.com/2279942"
        },
        {
          "url": "https://bugzilla.redhat.com/2405706"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279942"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405706"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33655"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11411"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18931.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18556"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00008.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00032.html"
        },
        {
          "url": "https://nlnetlabs.nl/news/2025/Nov/26/unbound-1.24.2-released/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11411"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7855-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7855-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11411"
        },
        {
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt"
        }
      ],
      "published": "2025-10-22T13:15:29+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-11468",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        93
      ],
      "description": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-11468"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-11468"
        },
        {
          "url": "https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094"
        },
        {
          "url": "https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2"
        },
        {
          "url": "https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6"
        },
        {
          "url": "https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66"
        },
        {
          "url": "https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0"
        },
        {
          "url": "https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796"
        },
        {
          "url": "https://github.com/python/cpython/issues/143935"
        },
        {
          "url": "https://github.com/python/cpython/pull/143936"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11468"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8018-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11468"
        }
      ],
      "published": "2026-01-20T22:15:50+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-11961",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 1.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "cwes": [
        122,
        126
      ],
      "description": "pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer.  The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented.  If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-11961"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-11961"
        },
        {
          "url": "https://github.com/the-tcpdump-group/libpcap/commit/b2d2f9a9a0581c40780bde509f7cc715920f1c02"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11961"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11961"
        }
      ],
      "published": "2025-12-31T01:15:54+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14",
          "versions": [
            {
              "version": "14:1.9.1-5.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-12781",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "cwes": [
        704
      ],
      "description": "When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python.\u00a0Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-12781"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-12781"
        },
        {
          "url": "https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b"
        },
        {
          "url": "https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947"
        },
        {
          "url": "https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5"
        },
        {
          "url": "https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76"
        },
        {
          "url": "https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5"
        },
        {
          "url": "https://github.com/python/cpython/issues/125346"
        },
        {
          "url": "https://github.com/python/cpython/pull/141128"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12781"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-12781"
        }
      ],
      "published": "2026-01-21T20:16:04+00:00",
      "updated": "2026-02-02T17:25:23+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-13034",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        295
      ],
      "description": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool,curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-13034"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-13034"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-13034.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-13034.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-9r76-qj98-jfhc"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13034"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
        }
      ],
      "published": "2026-01-08T10:15:45+00:00",
      "updated": "2026-01-20T14:54:02+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-13151",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-13151"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/01/08/5"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-13151"
        },
        {
          "url": "https://gitlab.com/gnutls/libtasn1"
        },
        {
          "url": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7954-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7954-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13151"
        },
        {
          "url": "https://www.kb.cert.org/vuls/id/271649"
        }
      ],
      "published": "2026-01-07T22:15:43+00:00",
      "updated": "2026-02-02T19:27:23+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.13-5.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-13837",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        400
      ],
      "description": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-13837"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-13837"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036"
        },
        {
          "url": "https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b"
        },
        {
          "url": "https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70"
        },
        {
          "url": "https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba"
        },
        {
          "url": "https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb"
        },
        {
          "url": "https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111"
        },
        {
          "url": "https://github.com/python/cpython/issues/119342"
        },
        {
          "url": "https://github.com/python/cpython/pull/119343"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-13837.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8018-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13837"
        }
      ],
      "published": "2025-12-01T18:16:04+00:00",
      "updated": "2026-03-03T15:16:14+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-14017",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 6.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "description": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-14017"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/01/07/3"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-14017"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-14017.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-14017.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-jh4h-2cg6-889h"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
        }
      ],
      "published": "2026-01-08T10:15:45+00:00",
      "updated": "2026-01-27T21:29:39+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-14087",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "critical"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        190
      ],
      "description": "A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.",
      "recommendation": "Upgrade glib2 to version 2.56.4-169.el8_10",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-14087"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:15953"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:15969"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:15971"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19148"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19361"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19452"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19457"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19459"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19460"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19523"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19524"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19565"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19566"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19567"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:22634"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7461"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-14087"
        },
        {
          "url": "https://bugzilla.redhat.com/2419093"
        },
        {
          "url": "https://bugzilla.redhat.com/2421339"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419093"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421339"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14087"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14512"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19361.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19148"
        },
        {
          "url": "https://github.com/advisories/GHSA-frh9-7wfp-w73p"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3834"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4933"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4934"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-14087.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-15971.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14087"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7942-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7942-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14087"
        }
      ],
      "published": "2025-12-10T09:15:47+00:00",
      "updated": "2026-06-02T20:16:30+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-14512",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        190
      ],
      "description": "A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.",
      "recommendation": "Upgrade glib2 to version 2.56.4-169.el8_10",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-14512"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:15953"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:15969"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:15971"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19148"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19361"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19452"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19457"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19459"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19460"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19523"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19524"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19565"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19567"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:22634"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7461"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-14512"
        },
        {
          "url": "https://bugzilla.redhat.com/2419093"
        },
        {
          "url": "https://bugzilla.redhat.com/2421339"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419093"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421339"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14087"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14512"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19361.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19148"
        },
        {
          "url": "https://github.com/advisories/GHSA-2p5v-p767-wqv5"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3845"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4935"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4936"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-14512.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-15971.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14512"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14512"
        }
      ],
      "published": "2025-12-11T07:16:00+00:00",
      "updated": "2026-06-02T20:16:31+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-14524",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        601
      ],
      "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-14524"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-14524"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-14524.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-14524.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-g897-jvjx-78vg"
        },
        {
          "url": "https://hackerone.com/reports/3459417"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
        }
      ],
      "published": "2026-01-08T10:15:46+00:00",
      "updated": "2026-01-20T14:53:11+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-15079",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 8.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        297
      ],
      "description": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-15079"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/01/07/6"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-15079"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-15079.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-15079.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-7q9p-cx8r-rh2q"
        },
        {
          "url": "https://hackerone.com/reports/3477116"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
        }
      ],
      "published": "2026-01-08T10:15:47+00:00",
      "updated": "2026-01-20T14:50:24+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2025-15224",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 3.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        287
      ],
      "description": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-15224"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/01/07/7"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-15224"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-15224.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-15224.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-hccr-q52r-4w88"
        },
        {
          "url": "https://hackerone.com/reports/3480925"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15224"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8062-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
        }
      ],
      "published": "2026-01-08T10:15:47+00:00",
      "updated": "2026-01-20T14:47:52+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-15282",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        93
      ],
      "description": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-15282"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-15282"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0"
        },
        {
          "url": "https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38"
        },
        {
          "url": "https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80"
        },
        {
          "url": "https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47"
        },
        {
          "url": "https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a"
        },
        {
          "url": "https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f"
        },
        {
          "url": "https://github.com/python/cpython/issues/143925"
        },
        {
          "url": "https://github.com/python/cpython/pull/143926"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-15282.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8018-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8018-3"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15282"
        }
      ],
      "published": "2026-01-20T22:15:50+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-15468",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-15468"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-15468"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-rhx3-fg8p-f9m4"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/7c88376731c589ee5b36116c5a6e32d5ae5f7ae2"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/b2539639400288a4580fe2d76247541b976bade4"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/d75b309879631d45b972396ce4e5102559c64ac7"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-15468.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15468"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15468"
        }
      ],
      "published": "2026-01-27T16:16:14+00:00",
      "updated": "2026-02-02T18:38:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-15469",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        347
      ],
      "description": "Issue summary: The 'openssl dgst' command-line tool silently truncates input\ndata to 16MB when using one-shot signing algorithms and reports success instead\nof an error.\n\nImpact summary: A user signing or verifying files larger than 16MB with\none-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire\nfile is authenticated while trailing data beyond 16MB remains unauthenticated.\n\nWhen the 'openssl dgst' command is used with algorithms that only support\none-shot signing (Ed25519, Ed448, ML-DSA-44, ML-DSA-65, ML-DSA-87), the input\nis buffered with a 16MB limit. If the input exceeds this limit, the tool\nsilently truncates to the first 16MB and continues without signaling an error,\ncontrary to what the documentation states. This creates an integrity gap where\ntrailing bytes can be modified without detection if both signing and\nverification are performed using the same affected codepath.\n\nThe issue affects only the command-line tool behavior. Verifiers that process\nthe full message using library APIs will reject the signature, so the risk\nprimarily affects workflows that both sign and verify with the affected\n'openssl dgst' command. Streaming digest algorithms for 'openssl dgst' and\nlibrary users are unaffected.\n\nThe FIPS modules in 3.5 and 3.6 are not affected by this issue, as the\ncommand-line tools are outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.5 and 3.6 are vulnerable to this issue.\n\nOpenSSL 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-15469"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-15469"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-v2vr-926q-29fr"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/310f305eb92ea8040d6b3cb75a5feeba8e6acf2f"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/a7936fa4bd23c906e1955a16a0a0ab39a4953a61"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-15469.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15469"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15469"
        }
      ],
      "published": "2026-01-27T16:16:14+00:00",
      "updated": "2026-02-02T18:37:39+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-1632",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        404,
        476
      ],
      "description": "A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-1632"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-1632"
        },
        {
          "url": "https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1632"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7454-1"
        },
        {
          "url": "https://vuldb.com/?ctiid.296619"
        },
        {
          "url": "https://vuldb.com/?id.296619"
        },
        {
          "url": "https://vuldb.com/?submit.496460"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1632"
        }
      ],
      "published": "2025-02-24T14:15:11+00:00",
      "updated": "2025-03-25T15:41:41+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-1795",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        116
      ],
      "description": "During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-1795"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-1795"
        },
        {
          "url": "https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48"
        },
        {
          "url": "https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593"
        },
        {
          "url": "https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74"
        },
        {
          "url": "https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d"
        },
        {
          "url": "https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090"
        },
        {
          "url": "https://github.com/python/cpython/issues/100884"
        },
        {
          "url": "https://github.com/python/cpython/pull/100885"
        },
        {
          "url": "https://github.com/python/cpython/pull/119099"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1795"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7570-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1795"
        }
      ],
      "published": "2025-02-28T19:15:36+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
          "versions": [
            {
              "version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
          "versions": [
            {
              "version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
          "versions": [
            {
              "version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-25724",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.8,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        252
      ],
      "description": "list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-25724"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:9431"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-25724"
        },
        {
          "url": "https://bugzilla.redhat.com/2349221"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349221"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25724"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-9431.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:9420"
        },
        {
          "url": "https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92"
        },
        {
          "url": "https://github.com/Ekkosun/pocs/blob/main/bsdtarbug"
        },
        {
          "url": "https://github.com/advisories/GHSA-722w-734r-qg74"
        },
        {
          "url": "https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-25724.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-9431.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25724"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7454-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8147-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-25724"
        }
      ],
      "published": "2025-03-02T02:15:36+00:00",
      "updated": "2025-07-17T15:56:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-27113",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "bitnami"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        476
      ],
      "description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-27113"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/11"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/12"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/13"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/4"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/5"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/8"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Apr/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-27113"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250306-0004/"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7302-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-27113"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/02/18/2"
        }
      ],
      "published": "2025-02-18T23:15:10+00:00",
      "updated": "2025-11-03T22:18:43+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-30258",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        754
      ],
      "description": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-30258"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-30258"
        },
        {
          "url": "https://dev.gnupg.org/T7527"
        },
        {
          "url": "https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158"
        },
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30258"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7412-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7412-3"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-30258"
        }
      ],
      "published": "2025-03-19T20:15:20+00:00",
      "updated": "2025-10-16T16:53:07+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.2.20-4.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-3360",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        190
      ],
      "description": "A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-3360"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-3360"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357754"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3360"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7942-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7942-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-3360"
        }
      ],
      "published": "2025-04-07T13:15:43+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-4516",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        416
      ],
      "description": "There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-4516"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/05/16/4"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/05/19/1"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:23530"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-4516"
        },
        {
          "url": "https://bugzilla.redhat.com/2294682"
        },
        {
          "url": "https://bugzilla.redhat.com/2321440"
        },
        {
          "url": "https://bugzilla.redhat.com/2325776"
        },
        {
          "url": "https://bugzilla.redhat.com/2343237"
        },
        {
          "url": "https://bugzilla.redhat.com/2366509"
        },
        {
          "url": "https://bugzilla.redhat.com/2370010"
        },
        {
          "url": "https://bugzilla.redhat.com/2370014"
        },
        {
          "url": "https://bugzilla.redhat.com/2370016"
        },
        {
          "url": "https://bugzilla.redhat.com/2372426"
        },
        {
          "url": "https://bugzilla.redhat.com/2373234"
        },
        {
          "url": "https://bugzilla.redhat.com/2402342"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2025-23530.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:23530"
        },
        {
          "url": "https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292"
        },
        {
          "url": "https://github.com/python/cpython/commit/5646648678295a44aa82636c6e92826651baf33a"
        },
        {
          "url": "https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d"
        },
        {
          "url": "https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142"
        },
        {
          "url": "https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f"
        },
        {
          "url": "https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77"
        },
        {
          "url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e"
        },
        {
          "url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e"
        },
        {
          "url": "https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b"
        },
        {
          "url": "https://github.com/python/cpython/issues/133767"
        },
        {
          "url": "https://github.com/python/cpython/pull/129648"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-4516.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-23530.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4516"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7570-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4516"
        }
      ],
      "published": "2025-05-15T14:15:31+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-45582",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        24
      ],
      "description": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-45582"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/11/01/6"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:0067"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-45582"
        },
        {
          "url": "https://bugzilla.redhat.com/2379592"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379592"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-45582"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-0067.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:0002"
        },
        {
          "url": "https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-45582.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-0067.html"
        },
        {
          "url": "https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45582"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-45582"
        },
        {
          "url": "https://www.gnu.org/software/tar/"
        },
        {
          "url": "https://www.gnu.org/software/tar/manual/html_node/Integrity.html"
        },
        {
          "url": "https://www.gnu.org/software/tar/manual/html_node/Integrity.html#Integrity"
        },
        {
          "url": "https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html"
        }
      ],
      "published": "2025-07-11T17:15:37+00:00",
      "updated": "2025-11-02T01:15:32+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-4598",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        364
      ],
      "description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-4598"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2025/Jun/9"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/06/05/1"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/06/05/3"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/08/18/3"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:22660"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:22868"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:23227"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:23234"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:0414"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1652"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18153"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-4598"
        },
        {
          "url": "https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598"
        },
        {
          "url": "https://bugzilla.redhat.com/2369242"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369242"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
        },
        {
          "url": "https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4598"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-22660.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18153"
        },
        {
          "url": "https://git.kernel.org/linus/b5325b2a270fcaf7b2a9a0f23d422ca8a5a8bdea"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/0c49e0049b7665bb7769a13ef346fef92e1ad4d6"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/13902e025321242b1d95c6d8b4e482b37f58cdef"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/49f1f2d4a7612bbed5211a73d11d6a94fbe3bb69"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/76e0ab49c47965877c19772a2b3bf55f6417ca39"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/868d95577ec9f862580ad365726515459be582fc"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/8fc7b2a211eb13ef1a94250b28e1c79cab8bdcb9"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/9ce8e3e449def92c75ada41b7d10c5bc3946be77"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/e6a8687b939ab21854f12f59a3cce703e32768cf"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-4598.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-22660.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4598"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7559-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4598"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/05/29/3"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/08/18/3"
        },
        {
          "url": "https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt"
        }
      ],
      "published": "2025-05-30T14:15:23+00:00",
      "updated": "2026-05-19T16:16:18+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-47268",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        190
      ],
      "description": "ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-47268"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:9432"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-47268"
        },
        {
          "url": "https://bugzilla.redhat.com/2364090"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364090"
        },
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1242300"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47268"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-9432.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:9421"
        },
        {
          "url": "https://github.com/Zephkek/ping-rtt-overflow/"
        },
        {
          "url": "https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40"
        },
        {
          "url": "https://github.com/iputils/iputils/issues/584"
        },
        {
          "url": "https://github.com/iputils/iputils/pull/585"
        },
        {
          "url": "https://github.com/iputils/iputils/releases/tag/20250602"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-47268.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-9432.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47268"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7670-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47268"
        }
      ],
      "published": "2025-05-05T14:15:29+00:00",
      "updated": "2026-04-06T14:12:20+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "20180629-11.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-4878",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.6,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        416
      ],
      "description": "A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-4878"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-4878"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18683"
        },
        {
          "url": "https://git.libssh.org/projects/libssh.git/commit/?id=697650caa97eaf7623924c75f9fcfec6dd423cd1"
        },
        {
          "url": "https://git.libssh.org/projects/libssh.git/commit/?id=b35ee876adc92a208d47194772e99f9c71e0bedb"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4878"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7619-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7696-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4878"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2025-4878.txt"
        }
      ],
      "published": "2025-07-22T15:15:36+00:00",
      "updated": "2026-05-19T14:16:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-48964",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        190
      ],
      "description": "ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-48964"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:17558"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-48964"
        },
        {
          "url": "https://bugzilla.redhat.com/2382657"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2382657"
        },
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1243772"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48964"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-17558.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18162"
        },
        {
          "url": "https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c"
        },
        {
          "url": "https://github.com/iputils/iputils/issues"
        },
        {
          "url": "https://github.com/iputils/iputils/releases/tag/20250602"
        },
        {
          "url": "https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-48964.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-17558.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48964"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7670-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48964"
        }
      ],
      "published": "2025-07-22T18:15:36+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "20180629-11.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-50181",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        601
      ],
      "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-50181"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-50181"
        },
        {
          "url": "https://github.com/urllib3/urllib3"
        },
        {
          "url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"
        },
        {
          "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
        },
        {
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7599-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7599-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-50181"
        }
      ],
      "published": "2025-06-19T01:15:24+00:00",
      "updated": "2025-12-22T19:15:49+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        }
      ]
    },
    {
      "id": "CVE-2025-50182",
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        601
      ],
      "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-50182"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-50182"
        },
        {
          "url": "https://github.com/urllib3/urllib3"
        },
        {
          "url": "https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"
        },
        {
          "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
        },
        {
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50182"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7599-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-50182"
        }
      ],
      "published": "2025-06-19T02:15:17+00:00",
      "updated": "2025-12-22T19:15:49+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-5278",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
        }
      ],
      "cwes": [
        121
      ],
      "description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-5278"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/05/27/2"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/05/29/1"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/05/29/2"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-5278"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368764"
        },
        {
          "url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633"
        },
        {
          "url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14"
        },
        {
          "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/CVE-2025-5278"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5278"
        }
      ],
      "published": "2025-05-27T21:15:23+00:00",
      "updated": "2026-05-19T17:16:21+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "8.30-17.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-5351",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        415
      ],
      "description": "A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-5351"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-5351"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18683"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5351"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7619-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5351"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2025-5351.txt"
        }
      ],
      "published": "2025-07-04T09:15:37+00:00",
      "updated": "2026-05-19T14:16:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-5915",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.6,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        122
      ],
      "description": "A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-5915"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-5915"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2599"
        },
        {
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5915"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7601-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5915"
        }
      ],
      "published": "2025-06-09T20:15:26+00:00",
      "updated": "2026-01-08T04:15:55+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-5916",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        190
      ],
      "description": "A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-5916"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-5916"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370872"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2568"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2568/commits/bce70c4c26864df2a8d6953e7db6e4b156253508"
        },
        {
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5916"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7601-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8147-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5916"
        }
      ],
      "published": "2025-06-09T20:15:27+00:00",
      "updated": "2025-12-12T01:15:46+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-5917",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-5917"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-5917"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370874"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2588"
        },
        {
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5917"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7601-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8147-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5917"
        }
      ],
      "published": "2025-06-09T20:15:27+00:00",
      "updated": "2025-12-12T01:15:46+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-5918",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        125
      ],
      "description": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-5918"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-5918"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2584"
        },
        {
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5918"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8147-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5918"
        }
      ],
      "published": "2025-06-09T20:15:27+00:00",
      "updated": "2025-08-15T18:35:04+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-6069",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "bitnami"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        1333
      ],
      "description": "The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-6069"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:23342"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-6069"
        },
        {
          "url": "https://bugzilla.redhat.com/2294682"
        },
        {
          "url": "https://bugzilla.redhat.com/2373234"
        },
        {
          "url": "https://bugzilla.redhat.com/2402342"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-23342.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:23342"
        },
        {
          "url": "https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949"
        },
        {
          "url": "https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41"
        },
        {
          "url": "https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41"
        },
        {
          "url": "https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49"
        },
        {
          "url": "https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5"
        },
        {
          "url": "https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b"
        },
        {
          "url": "https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc"
        },
        {
          "url": "https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15"
        },
        {
          "url": "https://github.com/python/cpython/issues/135462"
        },
        {
          "url": "https://github.com/python/cpython/pull/135464"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-6069.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2025-23530.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6069"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7710-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6069"
        }
      ],
      "published": "2025-06-17T14:15:33+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-6075",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        400
      ],
      "description": "If the value passed to os.path.expandvars() is user-controlled a \nperformance degradation is possible when expanding environment \nvariables.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-6075"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-6075"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c"
        },
        {
          "url": "https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427"
        },
        {
          "url": "https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84"
        },
        {
          "url": "https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca"
        },
        {
          "url": "https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742"
        },
        {
          "url": "https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba"
        },
        {
          "url": "https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c"
        },
        {
          "url": "https://github.com/python/cpython/issues/136065"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-6075.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6075"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7886-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7886-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6075"
        }
      ],
      "published": "2025-10-31T17:15:48+00:00",
      "updated": "2026-02-04T19:05:15+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-60753",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        400,
        835
      ],
      "description": "An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-60753"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-60753"
        },
        {
          "url": "https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753"
        },
        {
          "url": "https://github.com/libarchive/libarchive/issues/2725"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60753"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8147-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-60753"
        }
      ],
      "published": "2025-11-05T16:15:40+00:00",
      "updated": "2026-02-04T21:19:45+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-6170",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 2.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        121
      ],
      "description": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-6170"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7519"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-6170"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7694-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
        }
      ],
      "published": "2025-06-16T16:15:20+00:00",
      "updated": "2026-06-02T14:16:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-64118",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "cwes": [
        362,
        367
      ],
      "description": "node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-64118"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-64118"
        },
        {
          "url": "https://github.com/isaacs/node-tar"
        },
        {
          "url": "https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d"
        },
        {
          "url": "https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9"
        },
        {
          "url": "https://github.com/isaacs/node-tar/issues/445"
        },
        {
          "url": "https://github.com/isaacs/node-tar/pull/446"
        },
        {
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64118"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-64118"
        }
      ],
      "published": "2025-10-30T18:15:33+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-66382",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        407
      ],
      "description": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-66382"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2025/12/02/1"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-66382"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        },
        {
          "url": "https://github.com/libexpat/libexpat/issues/1076"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66382"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66382"
        }
      ],
      "published": "2025-11-28T07:15:57+00:00",
      "updated": "2026-06-02T14:16:37+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-68160",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-68160"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-68160"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-g78j-46j5-97cr"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-68160.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68160"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68160"
        }
      ],
      "published": "2026-01-27T16:16:15+00:00",
      "updated": "2026-05-12T13:17:24+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-68972",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
        }
      ],
      "cwes": [
        347
      ],
      "description": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-68972"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-68972"
        },
        {
          "url": "https://github.com/advisories/GHSA-w789-3q45-984r"
        },
        {
          "url": "https://gpg.fail/formfeed"
        },
        {
          "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i"
        },
        {
          "url": "https://news.ycombinator.com/item?id=46404339"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68972"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68972"
        }
      ],
      "published": "2025-12-27T23:15:40+00:00",
      "updated": "2026-01-09T20:08:47+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.2.20-4.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-69418",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        325
      ],
      "description": "Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subsequent tail-handling code then operates on the original<br>base pointers, effectively reprocessing the beginning of the buffer while<br>leaving the actual trailing bytes unprocessed. The authentication checksum<br>also excludes the true tail bytes.<br><br>However, typical OpenSSL consumers using EVP are not affected because the<br>higher-level EVP and provider OCB implementations split inputs so that full<br>blocks and trailing partial blocks are processed in separate calls, avoiding<br>the problematic code path. Additionally, TLS does not use OCB ciphersuites.<br>The vulnerability only affects applications that call the low-level<br>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with<br>non-block-aligned lengths in a single call on hardware-accelerated builds.<br>For these reasons the issue was assessed as Low severity.<br><br>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected<br>by this issue, as OCB mode is not a FIPS-approved algorithm.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.<br><br>OpenSSL 1.0.2 is not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-69418"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-69418"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-78qr-24v5-7q73"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-69418.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
        }
      ],
      "published": "2026-01-27T16:16:33+00:00",
      "updated": "2026-05-12T13:17:24+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-69420",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        754
      ],
      "description": "Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-69420"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-69420"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-w42r-ph9f-9x66"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-69420.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69420"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69420"
        }
      ],
      "published": "2026-01-27T16:16:34+00:00",
      "updated": "2026-05-12T13:17:26+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-69421",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-69421"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-69421"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-w9rv-xc8m-cmqp"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-69421.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69421"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69421"
        }
      ],
      "published": "2026-01-27T16:16:34+00:00",
      "updated": "2026-05-12T13:17:26+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2025-7039",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        22
      ],
      "description": "A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-7039"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-7039"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392423"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3716"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7039"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7942-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7942-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-7039"
        }
      ],
      "published": "2025-09-03T02:15:38+00:00",
      "updated": "2026-06-02T14:16:39+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-70873",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "bitnami"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
        }
      ],
      "cwes": [
        244
      ],
      "description": "An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-70873"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-70873"
        },
        {
          "url": "https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70873"
        },
        {
          "url": "https://sqlite.org/forum/forumpost/761eac3c82"
        },
        {
          "url": "https://sqlite.org/src/info/3d459f1fb1bd1b5e"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-70873"
        }
      ],
      "published": "2026-03-12T19:16:15+00:00",
      "updated": "2026-04-16T21:15:47+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.26.0-20.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-8114",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-8114"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-8114"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18683"
        },
        {
          "url": "https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d"
        },
        {
          "url": "https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8114"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7849-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-8114"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2025-8114.txt"
        }
      ],
      "published": "2025-07-24T15:15:27+00:00",
      "updated": "2026-05-19T14:16:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-8277",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        401
      ],
      "description": "A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-8277"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-8277"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18683"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8277"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-8277"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2025-8277.txt"
        }
      ],
      "published": "2025-09-09T12:15:30+00:00",
      "updated": "2026-05-19T14:16:29+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2025-8291",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "bitnami"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        1285
      ],
      "description": "The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-8291"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2025:23342"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-8291"
        },
        {
          "url": "https://bugzilla.redhat.com/2294682"
        },
        {
          "url": "https://bugzilla.redhat.com/2373234"
        },
        {
          "url": "https://bugzilla.redhat.com/2402342"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2025-23342.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2025:23940"
        },
        {
          "url": "https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p"
        },
        {
          "url": "https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"
        },
        {
          "url": "https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267"
        },
        {
          "url": "https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46"
        },
        {
          "url": "https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6"
        },
        {
          "url": "https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196"
        },
        {
          "url": "https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4"
        },
        {
          "url": "https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388"
        },
        {
          "url": "https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3"
        },
        {
          "url": "https://github.com/python/cpython/issues/139700"
        },
        {
          "url": "https://github.com/python/cpython/pull/139702"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2025-8291.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-0123.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8291"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7886-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7886-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-8291"
        }
      ],
      "published": "2025-10-07T18:16:00+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0672",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        93
      ],
      "description": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0672"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0672"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172"
        },
        {
          "url": "https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440"
        },
        {
          "url": "https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d"
        },
        {
          "url": "https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca"
        },
        {
          "url": "https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70"
        },
        {
          "url": "https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85"
        },
        {
          "url": "https://github.com/python/cpython/issues/143919"
        },
        {
          "url": "https://github.com/python/cpython/pull/143920"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-0672.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0672"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8018-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8018-3"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0672"
        }
      ],
      "published": "2026-01-20T22:15:52+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0964",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        22
      ],
      "description": "A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0964"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18160"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0964"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18160"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0964"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0964"
        },
        {
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2026-0964.txt"
        }
      ],
      "published": "2026-03-26T21:17:00+00:00",
      "updated": "2026-05-19T14:16:32+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0965",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        73
      ],
      "description": "A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0965"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18160"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0965"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18160"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0965"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0965"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2026-0965.txt"
        }
      ],
      "published": "2026-03-26T21:17:00+00:00",
      "updated": "2026-05-19T14:16:33+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0966",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 8.2,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        124
      ],
      "description": "A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0966"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18160"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7067"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0966"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18160"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0966"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0966"
        },
        {
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2026-0966.txt"
        }
      ],
      "published": "2026-03-26T21:17:00+00:00",
      "updated": "2026-05-19T14:16:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0967",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.2,
          "severity": "low",
          "method": "CVSSv3",
          "vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        1333
      ],
      "description": "A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0967"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18160"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0967"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18160"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0967"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0967"
        },
        {
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2026-0967.txt"
        }
      ],
      "published": "2026-03-26T21:17:00+00:00",
      "updated": "2026-05-19T14:16:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0968",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 3.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        476
      ],
      "description": "A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0968"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18160"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:18683"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0968"
        },
        {
          "url": "https://bugzilla.redhat.com/2369367"
        },
        {
          "url": "https://bugzilla.redhat.com/2376184"
        },
        {
          "url": "https://bugzilla.redhat.com/2376193"
        },
        {
          "url": "https://bugzilla.redhat.com/2383220"
        },
        {
          "url": "https://bugzilla.redhat.com/2383888"
        },
        {
          "url": "https://bugzilla.redhat.com/2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/2436982"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:18160"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0968"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8051-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0968"
        },
        {
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        },
        {
          "url": "https://www.libssh.org/security/advisories/CVE-2026-0968.txt"
        }
      ],
      "published": "2026-03-26T21:17:01+00:00",
      "updated": "2026-05-19T14:16:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0988",
      "ratings": [
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        190
      ],
      "description": "A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0988"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7461"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0988"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429886"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3851"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0988"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7971-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0988"
        }
      ],
      "published": "2026-01-21T12:15:55+00:00",
      "updated": "2026-04-24T21:16:17+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0989",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        674
      ],
      "description": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0989"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7519"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0989"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/998"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0989"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7974-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0989"
        }
      ],
      "published": "2026-01-15T15:15:52+00:00",
      "updated": "2026-04-22T10:16:49+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0990",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        674
      ],
      "description": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0990"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7519"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0990"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0990"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7974-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0990"
        }
      ],
      "published": "2026-01-15T15:15:52+00:00",
      "updated": "2026-04-22T10:16:50+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0992",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        400
      ],
      "description": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0992"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7519"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0992"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0992"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7974-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0992"
        }
      ],
      "published": "2026-01-15T15:15:52+00:00",
      "updated": "2026-04-22T10:16:50+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-1484",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-1484"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-1484"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433259"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3870"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1484"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8017-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1484"
        }
      ],
      "published": "2026-01-27T14:15:56+00:00",
      "updated": "2026-06-02T14:16:45+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-1485",
      "ratings": [
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        124
      ],
      "description": "A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-1485"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-1485"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1485"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8017-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1485"
        }
      ],
      "published": "2026-01-27T14:15:56+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-1489",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-1489"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-1489"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433348"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3872"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1489"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8017-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1489"
        }
      ],
      "published": "2026-01-27T15:15:57+00:00",
      "updated": "2026-06-02T14:16:45+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.56.4-168.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-1502",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        }
      ],
      "cwes": [
        93
      ],
      "description": "CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-1502"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/11/4"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-1502"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69"
        },
        {
          "url": "https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd"
        },
        {
          "url": "https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed"
        },
        {
          "url": "https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec"
        },
        {
          "url": "https://github.com/python/cpython/issues/146211"
        },
        {
          "url": "https://github.com/python/cpython/pull/146212"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-1502.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1502"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1502"
        }
      ],
      "published": "2026-04-10T18:16:40+00:00",
      "updated": "2026-06-04T15:16:50+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-1757",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        401
      ],
      "description": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-1757"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7519"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-1757"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1757"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1757"
        }
      ],
      "published": "2026-02-02T13:15:58+00:00",
      "updated": "2026-04-22T10:16:50+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-1965",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        305
      ],
      "description": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with  `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-1965"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-1965"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-1965.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-1965.json"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8084-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8099-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
        }
      ],
      "published": "2026-03-11T11:15:59+00:00",
      "updated": "2026-03-12T14:11:19+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-22185",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        125,
        191
      ],
      "description": "OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-22185"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-22185"
        },
        {
          "url": "https://bugs.openldap.org/show_bug.cgi?id=10421"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22185"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Jan/5"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Jan/8"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22185"
        },
        {
          "url": "https://www.openldap.org/"
        },
        {
          "url": "https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline"
        }
      ],
      "published": "2026-01-07T21:16:01+00:00",
      "updated": "2026-04-15T00:35:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.4.46-21.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-22795",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        754
      ],
      "description": "Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-22795"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-22795"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-3vqq-45qg-2xf6"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-22795.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22795"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22795"
        }
      ],
      "published": "2026-01-27T16:16:35+00:00",
      "updated": "2026-05-12T13:17:32+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2026-22796",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        754
      ],
      "description": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-22796"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:1473"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-22796"
        },
        {
          "url": "https://bugzilla.redhat.com/2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/2430390"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:1472"
        },
        {
          "url": "https://github.com/advisories/GHSA-r9hf-rxjm-gv2f"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-22796.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22796"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260127.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-7980-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22796"
        }
      ],
      "published": "2026-01-27T16:16:35+00:00",
      "updated": "2026-05-12T13:17:32+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2026-2297",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        668
      ],
      "description": "The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-2297"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/05/6"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-2297"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e"
        },
        {
          "url": "https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9"
        },
        {
          "url": "https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89dd"
        },
        {
          "url": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e"
        },
        {
          "url": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86"
        },
        {
          "url": "https://github.com/python/cpython/issues/145506"
        },
        {
          "url": "https://github.com/python/cpython/pull/145507"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-2297.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2297"
        }
      ],
      "published": "2026-03-04T23:16:10+00:00",
      "updated": "2026-05-01T16:16:30+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-24281",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "bitnami"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "cwes": [
        295,
        350
      ],
      "description": "Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.",
      "recommendation": "Upgrade org.apache.zookeeper:zookeeper to version 3.8.6, 3.9.5",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-24281"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/07/4"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-24281"
        },
        {
          "url": "https://github.com/apache/zookeeper"
        },
        {
          "url": "https://github.com/apache/zookeeper/commit/66c4efecdda1302d9cfb3af9eedb122b74452bf3"
        },
        {
          "url": "https://issues.apache.org/jira/browse/ZOOKEEPER-4986"
        },
        {
          "url": "https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24281"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24281"
        }
      ],
      "published": "2026-03-07T09:16:07+00:00",
      "updated": "2026-03-10T18:18:17+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.4",
          "versions": [
            {
              "version": "3.8.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#19118be5-10af-447c-a126-1ddd5d60f883"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5e5f93d8-2f16-479a-922e-186c092adb26"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#87f227e2-9311-4eb5-9635-890383193f7f"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#20598e7b-3ef1-4d31-bc31-23ae6b85d131"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#82165785-aea0-4d0c-90b1-ab8fb55fad4f"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#944990db-e06e-46fe-8461-a255142df252"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#07a2775e-3fa6-4ced-b62b-7bfa438fbef7"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0ae642b8-79e7-4869-b97b-1eff171f152e"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1a43d180-b0d3-4cee-8650-fb91eedbdb25"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3502c6ac-80ca-409c-aee8-3c3b76a7de06"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#04fef94d-bca1-4ba2-9d5b-974a6880d2b6"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#06e892a9-426b-4cd2-a5af-23157c17f637"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0ab478c8-204b-475e-a309-34fcb9f20f74"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#52aa803b-01ab-45d2-9402-2aedd67e6b17"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#5518e97f-6d2a-4959-b699-fbff99de3a1e"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#4a389bfd-9723-4e95-832e-45c73c815794"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6499e5de-6ae8-4184-a96b-cb5997e83074"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-24308",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "bitnami"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "cwes": [
        532
      ],
      "description": "Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue.\u00a0Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.",
      "recommendation": "Upgrade org.apache.zookeeper:zookeeper to version 3.9.5, 3.8.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-24308"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/07/5"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-24308"
        },
        {
          "url": "https://github.com/apache/zookeeper"
        },
        {
          "url": "https://github.com/apache/zookeeper/releases/tag/release-3.8.6"
        },
        {
          "url": "https://github.com/apache/zookeeper/releases/tag/release-3.9.5"
        },
        {
          "url": "https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24308"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24308"
        }
      ],
      "published": "2026-03-07T09:16:07+00:00",
      "updated": "2026-03-10T18:18:27+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.4",
          "versions": [
            {
              "version": "3.8.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#19118be5-10af-447c-a126-1ddd5d60f883"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5e5f93d8-2f16-479a-922e-186c092adb26"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#87f227e2-9311-4eb5-9635-890383193f7f"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#20598e7b-3ef1-4d31-bc31-23ae6b85d131"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#82165785-aea0-4d0c-90b1-ab8fb55fad4f"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#944990db-e06e-46fe-8461-a255142df252"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#07a2775e-3fa6-4ced-b62b-7bfa438fbef7"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0ae642b8-79e7-4869-b97b-1eff171f152e"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1a43d180-b0d3-4cee-8650-fb91eedbdb25"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3502c6ac-80ca-409c-aee8-3c3b76a7de06"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#04fef94d-bca1-4ba2-9d5b-974a6880d2b6"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#06e892a9-426b-4cd2-a5af-23157c17f637"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0ab478c8-204b-475e-a309-34fcb9f20f74"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#52aa803b-01ab-45d2-9402-2aedd67e6b17"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#5518e97f-6d2a-4959-b699-fbff99de3a1e"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#4a389bfd-9723-4e95-832e-45c73c815794"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6499e5de-6ae8-4184-a96b-cb5997e83074"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-24515",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 2.5,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 2.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        476
      ],
      "description": "In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-24515"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-24515"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1131"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24515"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8022-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8022-2"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8023-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24515"
        }
      ],
      "published": "2026-01-23T08:16:01+00:00",
      "updated": "2026-06-02T14:16:49+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-24883",
      "ratings": [
        {
          "source": {
            "name": "julia"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        476
      ],
      "description": "In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-24883"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-24883"
        },
        {
          "url": "https://dev.gnupg.org/T8049"
        },
        {
          "url": "https://github.com/advisories/GHSA-7246-cvp4-g68w"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24883"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24883"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        }
      ],
      "published": "2026-01-27T19:16:16+00:00",
      "updated": "2026-02-06T18:06:07+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.2.20-4.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-25645",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 4.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "cwes": [
        377
      ],
      "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.",
      "recommendation": "; Upgrade requests to version 2.33.0",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-25645"
        },
        {
          "url": "https://github.com/psf/requests"
        },
        {
          "url": "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"
        },
        {
          "url": "https://github.com/psf/requests/releases/tag/v2.33.0"
        },
        {
          "url": "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25645"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25645"
        }
      ],
      "published": "2026-03-25T17:16:52+00:00",
      "updated": "2026-03-30T14:23:16+00:00",
      "affects": [
        {
          "ref": "pkg:pypi/requests@2.32.5",
          "versions": [
            {
              "version": "2.32.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "9.0.3-24.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:pypi/requests@2.32.5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2026-27171",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 2.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        1284
      ],
      "description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-27171"
        },
        {
          "url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit"
        },
        {
          "url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/"
        },
        {
          "url": "https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-27171"
        },
        {
          "url": "https://github.com/advisories/GHSA-h858-mf2m-8jf4"
        },
        {
          "url": "https://github.com/madler/zlib/issues/904"
        },
        {
          "url": "https://github.com/madler/zlib/releases/tag/v1.3.2"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27171"
        },
        {
          "url": "https://ostif.org/zlib-audit-complete"
        },
        {
          "url": "https://ostif.org/zlib-audit-complete/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27171"
        }
      ],
      "published": "2026-02-18T04:16:01+00:00",
      "updated": "2026-03-25T21:27:04+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.2.11-25.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-27456",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        59,
        269,
        367
      ],
      "description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-27456"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-27456"
        },
        {
          "url": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4"
        },
        {
          "url": "https://github.com/util-linux/util-linux/releases/tag/v2.41.4"
        },
        {
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27456"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27456"
        }
      ],
      "published": "2026-04-03T22:16:25+00:00",
      "updated": "2026-04-22T16:08:55+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.32.1-48.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.32.1-48.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.32.1-48.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.32.1-48.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.32.1-48.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.32.1-48.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-28387",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 8.1,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        416
      ],
      "description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-28387"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-28387"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28387"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28387"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
        }
      ],
      "published": "2026-04-07T22:16:20+00:00",
      "updated": "2026-05-12T13:17:33+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-28388",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-28388"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-28388"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28388"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28388"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
        }
      ],
      "published": "2026-04-07T22:16:20+00:00",
      "updated": "2026-05-12T13:17:33+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-28389",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-28389"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-28389"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://github.com/advisories/GHSA-7x88-9hgc-69gf"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28389"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28389"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
        }
      ],
      "published": "2026-04-07T22:16:21+00:00",
      "updated": "2026-05-12T13:17:33+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-28390",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        476
      ],
      "description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-28390"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:22313"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-28390"
        },
        {
          "url": "https://bugzilla.redhat.com/2456314"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456314"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-22313.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:22314"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-28390.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-22315.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
        }
      ],
      "published": "2026-04-07T22:16:21+00:00",
      "updated": "2026-05-12T13:17:33+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-29111",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        269
      ],
      "description": "systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-29111"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19213"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-29111"
        },
        {
          "url": "https://bugzilla.redhat.com/2450505"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29111"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19213.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19068"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
        },
        {
          "url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
        },
        {
          "url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-29111.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-13677.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8119-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8119-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
        }
      ],
      "published": "2026-03-23T22:16:26+00:00",
      "updated": "2026-04-15T16:44:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-31789",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "critical"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-31789"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-31789"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
        },
        {
          "url": "https://github.com/advisories/GHSA-j79m-9jxq-788r"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31789"
        },
        {
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8155-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31789"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
        }
      ],
      "published": "2026-04-07T22:16:21+00:00",
      "updated": "2026-05-12T13:17:34+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
          "versions": [
            {
              "version": "1:1.1.1k-15.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3276",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        407
      ],
      "description": "unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3276"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/06/03/15"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3276"
        },
        {
          "url": "https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0"
        },
        {
          "url": "https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f"
        },
        {
          "url": "https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32"
        },
        {
          "url": "https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066"
        },
        {
          "url": "https://github.com/python/cpython/issues/149079"
        },
        {
          "url": "https://github.com/python/cpython/pull/149080"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3276"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3276"
        }
      ],
      "published": "2026-06-03T16:16:29+00:00",
      "updated": "2026-06-04T18:16:30+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-32776",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        476
      ],
      "description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-32776"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-32776"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1158"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1159"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32776"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32776"
        }
      ],
      "published": "2026-03-16T14:19:44+00:00",
      "updated": "2026-03-17T15:52:09+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-32777",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        835
      ],
      "description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-32777"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-32777"
        },
        {
          "url": "https://github.com/libexpat/libexpat/issues/1161"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1159"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1162"
        },
        {
          "url": "https://issues.oss-fuzz.com/issues/486993411"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32777"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32777"
        }
      ],
      "published": "2026-03-16T14:19:44+00:00",
      "updated": "2026-03-17T15:52:34+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-32778",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        476
      ],
      "description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-32778"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-32778"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1159"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1163"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32778"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32778"
        }
      ],
      "published": "2026-03-16T14:19:44+00:00",
      "updated": "2026-03-17T15:52:53+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-32792",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        125,
        166
      ],
      "description": "NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-32792"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-32792"
        },
        {
          "url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32792"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32792"
        },
        {
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt"
        }
      ],
      "published": "2026-05-20T10:16:26+00:00",
      "updated": "2026-05-20T22:44:09+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-33056",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        61
      ],
      "description": "tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory \u2014 and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-33056"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-33056"
        },
        {
          "url": "https://github.com/alexcrichton/tar-rs"
        },
        {
          "url": "https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446"
        },
        {
          "url": "https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33056"
        },
        {
          "url": "https://rustsec.org/advisories/RUSTSEC-2026-0067.html"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8138-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8139-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8168-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33056"
        }
      ],
      "published": "2026-03-20T08:16:11+00:00",
      "updated": "2026-03-24T16:17:11+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-33845",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.1,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "critical"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        191
      ],
      "description": "A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-33845"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:13274"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-33845"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-33845.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33845"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33845"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-3"
        }
      ],
      "published": "2026-04-30T18:16:28+00:00",
      "updated": "2026-06-02T16:16:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-33846",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        130
      ],
      "description": "A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-33846"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:13274"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-33846"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-33846.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33846"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33846"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-1"
        }
      ],
      "published": "2026-05-04T10:15:59+00:00",
      "updated": "2026-06-02T16:16:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-34743",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        122
      ],
      "description": "XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-34743"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/31/13"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-34743"
        },
        {
          "url": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87"
        },
        {
          "url": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3"
        },
        {
          "url": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743"
        },
        {
          "url": "https://tukaani.org/xz/index-append-overflow.html"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8362-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34743"
        }
      ],
      "published": "2026-04-02T19:21:33+00:00",
      "updated": "2026-04-15T17:33:17+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "5.2.4-4.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3479",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "cwes": [
        22
      ],
      "description": "DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.\n\npkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3479"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3479"
        },
        {
          "url": "https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe"
        },
        {
          "url": "https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7"
        },
        {
          "url": "https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943"
        },
        {
          "url": "https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c"
        },
        {
          "url": "https://github.com/python/cpython/issues/146121"
        },
        {
          "url": "https://github.com/python/cpython/pull/146122"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3479"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3479"
        }
      ],
      "published": "2026-03-18T19:16:06+00:00",
      "updated": "2026-04-07T18:16:46+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3644",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        }
      ],
      "cwes": [
        20,
        116
      ],
      "description": "The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3644"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3644"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4"
        },
        {
          "url": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd"
        },
        {
          "url": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd"
        },
        {
          "url": "https://github.com/python/cpython/issues/145599"
        },
        {
          "url": "https://github.com/python/cpython/pull/145600"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-3644.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3644"
        }
      ],
      "published": "2026-03-16T18:16:09+00:00",
      "updated": "2026-06-04T19:30:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3731",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        119,
        125
      ],
      "description": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3731"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3731"
        },
        {
          "url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8093-1"
        },
        {
          "url": "https://vuldb.com/?ctiid.349709"
        },
        {
          "url": "https://vuldb.com/?id.349709"
        },
        {
          "url": "https://vuldb.com/?submit.767120"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3731"
        },
        {
          "url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz"
        },
        {
          "url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"
        }
      ],
      "published": "2026-03-08T11:15:50+00:00",
      "updated": "2026-03-12T19:02:31+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.9.6-16.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3783",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        522
      ],
      "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3783"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3783"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-3783.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-3783.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-8whr-249c-vfjp"
        },
        {
          "url": "https://hackerone.com/reports/3583983"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8084-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8099-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
        }
      ],
      "published": "2026-03-11T11:16:00+00:00",
      "updated": "2026-03-12T14:10:37+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3784",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        305
      ],
      "description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3784"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3784"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-3784.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-3784.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-5q3w-6p3j-mw6p"
        },
        {
          "url": "https://hackerone.com/reports/3584903"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8084-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8099-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
        }
      ],
      "published": "2026-03-11T11:16:00+00:00",
      "updated": "2026-06-02T14:16:52+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3805",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        416
      ],
      "description": "When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3805"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/11/4"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3805"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-3805.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-3805.json"
        },
        {
          "url": "https://github.com/advisories/GHSA-2289-hhfc-p684"
        },
        {
          "url": "https://hackerone.com/reports/3591944"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3805"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8084-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3805"
        }
      ],
      "published": "2026-03-11T11:16:00+00:00",
      "updated": "2026-03-12T14:08:56+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3832",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        179
      ],
      "description": "A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3832"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:13274"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3832"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1801"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3832"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3832"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-12"
        }
      ],
      "published": "2026-04-30T18:16:30+00:00",
      "updated": "2026-06-02T17:16:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-3833",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        178
      ],
      "description": "A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-3833"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:13274"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-3833"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1803"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-3833.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3833"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-5"
        }
      ],
      "published": "2026-04-30T18:16:30+00:00",
      "updated": "2026-06-02T16:16:38+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-40355",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        }
      ],
      "cwes": [
        476
      ],
      "description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
      "recommendation": "Upgrade krb5-libs to version 1.18.2-34.el8_10; Upgrade krb5-workstation to version 1.18.2-34.el8_10; Upgrade libkadm5 to version 1.18.2-34.el8_10",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-40355"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19357"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-40355"
        },
        {
          "url": "https://bugzilla.redhat.com/2463368"
        },
        {
          "url": "https://bugzilla.redhat.com/2463370"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463368"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463370"
        },
        {
          "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19357.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19145"
        },
        {
          "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-40355.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-16799.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40355"
        },
        {
          "url": "https://web.mit.edu/kerberos/advisories/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40355"
        }
      ],
      "published": "2026-04-28T06:16:03+00:00",
      "updated": "2026-04-28T20:11:56+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.18.2-33.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.18.2-33.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.18.2-33.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2026-40356",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        }
      ],
      "cwes": [
        191
      ],
      "description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
      "recommendation": "Upgrade krb5-libs to version 1.18.2-34.el8_10; Upgrade krb5-workstation to version 1.18.2-34.el8_10; Upgrade libkadm5 to version 1.18.2-34.el8_10",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-40356"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19357"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-40356"
        },
        {
          "url": "https://bugzilla.redhat.com/2463368"
        },
        {
          "url": "https://bugzilla.redhat.com/2463370"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463368"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463370"
        },
        {
          "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19357.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19145"
        },
        {
          "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-40356.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-16799.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356"
        },
        {
          "url": "https://web.mit.edu/kerberos/advisories/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40356"
        }
      ],
      "published": "2026-04-28T07:16:03+00:00",
      "updated": "2026-04-28T20:11:56+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.18.2-33.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.18.2-33.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.18.2-33.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/krb5-libs@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/krb5-workstation@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libkadm5@1.18.2-33.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n        linux-vdso.so.1 (0x0000ffff8cd00000)\n        libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n        libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n        libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n        /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
      }
    },
    {
      "id": "CVE-2026-4046",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        617
      ],
      "description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.\n\n\n\nThis vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.",
      "recommendation": "Upgrade glibc to version 2.28-251.el8_10.37; Upgrade glibc-common to version 2.28-251.el8_10.37; Upgrade glibc-minimal-langpack to version 2.28-251.el8_10.37",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-4046"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20587"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-4046"
        },
        {
          "url": "https://bugzilla.redhat.com/2453117"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453117"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4046"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20587.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20594"
        },
        {
          "url": "https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/#u"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-4046.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-50291.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4046"
        },
        {
          "url": "https://packages.fedoraproject.org/pkgs/glibc/glibc-gconv-extra/"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33980"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4046"
        }
      ],
      "published": "2026-03-30T18:16:19+00:00",
      "updated": "2026-04-20T22:16:23+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-4105",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        284
      ],
      "description": "A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-4105"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:7299"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-4105"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447262"
        },
        {
          "url": "https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4105"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4105"
        }
      ],
      "published": "2026-03-13T19:55:13+00:00",
      "updated": "2026-04-30T17:16:26+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "239-82.el8_10.16",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-41080",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        331
      ],
      "description": "libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-41080"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/26/1"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-41080"
        },
        {
          "url": "https://blog.hartwork.org/posts/expat-2-8-0-released/"
        },
        {
          "url": "https://github.com/libexpat/libexpat/issues/47"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1183"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41080"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41080"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/26/1"
        }
      ],
      "published": "2026-04-16T17:16:54+00:00",
      "updated": "2026-04-27T07:16:03+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-41989",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "julia"
          },
          "score": 6.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-41989"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-41989"
        },
        {
          "url": "https://dev.gnupg.org/T8211"
        },
        {
          "url": "https://github.com/advisories/GHSA-wrv8-79m2-qg24"
        },
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8319-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        }
      ],
      "published": "2026-04-23T05:16:05+00:00",
      "updated": "2026-04-27T18:33:18+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.8.5-7.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-41990",
      "ratings": [
        {
          "source": {
            "name": "julia"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.3,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-41990"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-41990"
        },
        {
          "url": "https://dev.gnupg.org/T8208"
        },
        {
          "url": "https://github.com/advisories/GHSA-78pv-qq8x-94px"
        },
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41990"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8319-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41990"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        }
      ],
      "published": "2026-04-23T05:16:05+00:00",
      "updated": "2026-04-27T18:33:27+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.8.5-7.el8_6",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42009",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        475
      ],
      "description": "A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42009"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:13274"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42009"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42009.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42009"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42009"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2"
        }
      ],
      "published": "2026-05-18T13:16:32+00:00",
      "updated": "2026-06-08T17:16:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-42010",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "critical"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.1,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        626
      ],
      "description": "A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest\u2013Shamir\u2013Adleman \u2013 Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42010"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:13274"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42010"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42010.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42010"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42010"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4"
        }
      ],
      "published": "2026-05-07T12:16:17+00:00",
      "updated": "2026-06-02T16:16:39+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42011",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        295
      ],
      "description": "A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42011"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:13274"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42011"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42011.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42011"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6"
        }
      ],
      "published": "2026-05-07T15:16:09+00:00",
      "updated": "2026-06-02T16:16:39+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42012",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        295
      ],
      "description": "A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42012"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42012"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42012.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42012"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7"
        }
      ],
      "published": "2026-05-26T22:16:41+00:00",
      "updated": "2026-06-02T16:16:39+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-42013",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 8.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        1284
      ],
      "description": "A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42013"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42013"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42013.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42013"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8"
        }
      ],
      "published": "2026-05-26T22:16:42+00:00",
      "updated": "2026-06-02T16:16:40+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-42014",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "description": "No description is available for this CVE.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42014"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42014"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42014.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42014"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42014"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-9"
        }
      ],
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42015",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        193
      ],
      "description": "A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42015"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42015"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42015.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42015"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42015"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-11"
        }
      ],
      "published": "2026-05-26T22:16:42+00:00",
      "updated": "2026-06-02T16:16:40+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-4224",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        }
      ],
      "cwes": [
        674
      ],
      "description": "When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-4224"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/03/16/4"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19177"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-4224"
        },
        {
          "url": "https://bugzilla.redhat.com/2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19064"
        },
        {
          "url": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a"
        },
        {
          "url": "https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785"
        },
        {
          "url": "https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee"
        },
        {
          "url": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3"
        },
        {
          "url": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768"
        },
        {
          "url": "https://github.com/python/cpython/issues/145986"
        },
        {
          "url": "https://github.com/python/cpython/pull/145987"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-4224.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4224"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4224"
        }
      ],
      "published": "2026-03-16T18:16:10+00:00",
      "updated": "2026-06-04T19:33:19+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42250",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "bzip2 contains an off\u2011by\u2011one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out\u2011of\u2011bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch\u00a035d122a3df8b0cc4082a4d89fdc6ee99f375fe67",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42250"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42250"
        },
        {
          "url": "https://cert.pl/en/posts/2026/05/CVE-2026-42250/"
        },
        {
          "url": "https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42250"
        },
        {
          "url": "https://sourceware.org/bzip2/"
        },
        {
          "url": "https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42250"
        }
      ],
      "published": "2026-05-28T14:16:19+00:00",
      "updated": "2026-06-05T08:16:30+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.0.6-28.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ]
    },
    {
      "id": "CVE-2026-42308",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        190
      ],
      "description": "Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42308"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42308"
        },
        {
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"
        },
        {
          "url": "https://github.com/python-pillow/Pillow"
        },
        {
          "url": "https://github.com/python-pillow/Pillow/pull/9518/changes"
        },
        {
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0"
        },
        {
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42308"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8399-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42308"
        }
      ],
      "published": "2026-05-09T06:16:09+00:00",
      "updated": "2026-05-12T17:57:20+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42923",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        407
      ],
      "description": "NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42923"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42923"
        },
        {
          "url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42923"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42923"
        },
        {
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt"
        }
      ],
      "published": "2026-05-20T10:16:27+00:00",
      "updated": "2026-05-20T22:50:35+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42944",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        197,
        787
      ],
      "description": "NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.",
      "recommendation": "Upgrade python3-unbound to version 1.16.2-5.11.el8_10; Upgrade unbound-libs to version 1.16.2-5.11.el8_10",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42944"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:24365"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42944"
        },
        {
          "url": "https://bugzilla.redhat.com/2479774"
        },
        {
          "url": "https://bugzilla.redhat.com/2479806"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-24365.html"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42944.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-24365.html"
        },
        {
          "url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42944"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42944"
        },
        {
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt"
        }
      ],
      "published": "2026-05-20T10:16:27+00:00",
      "updated": "2026-05-20T22:50:49+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-42959",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        824
      ],
      "description": "NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.",
      "recommendation": "Upgrade python3-unbound to version 1.16.2-5.11.el8_10; Upgrade unbound-libs to version 1.16.2-5.11.el8_10",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42959"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:24365"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42959"
        },
        {
          "url": "https://bugzilla.redhat.com/2479774"
        },
        {
          "url": "https://bugzilla.redhat.com/2479806"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-24365.html"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-42959.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-24365.html"
        },
        {
          "url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42959"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42959"
        },
        {
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt"
        }
      ],
      "published": "2026-05-20T10:16:27+00:00",
      "updated": "2026-05-20T22:51:00+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-42960",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 10,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "critical"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        349
      ],
      "description": "NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42960"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42960"
        },
        {
          "url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42960"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42960"
        },
        {
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt"
        }
      ],
      "published": "2026-05-20T10:16:28+00:00",
      "updated": "2026-05-20T22:51:43+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-4426",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        1335
      ],
      "description": "A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-4426"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:8944"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-4426"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449010"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2897"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4426"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8292-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4426"
        }
      ],
      "published": "2026-03-19T15:16:28+00:00",
      "updated": "2026-05-03T21:16:11+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-4437",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        125
      ],
      "description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-4437"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19061"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-4437"
        },
        {
          "url": "https://bugzilla.redhat.com/2449777"
        },
        {
          "url": "https://bugzilla.redhat.com/2449783"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449777"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449783"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4437"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4438"
        },
        {
          "url": "https://errata.almalinux.org/10/ALSA-2026-19061.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19061"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4437"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34014"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4437"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/03/23/2"
        }
      ],
      "published": "2026-03-20T20:16:49+00:00",
      "updated": "2026-04-07T18:41:36+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-4438",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        20,
        88
      ],
      "description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-4438"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19061"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-4438"
        },
        {
          "url": "https://bugzilla.redhat.com/2449777"
        },
        {
          "url": "https://bugzilla.redhat.com/2449783"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449777"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449783"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4437"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4438"
        },
        {
          "url": "https://errata.almalinux.org/10/ALSA-2026-19061.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19061"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4438"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34015"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4438"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/03/23/2"
        }
      ],
      "published": "2026-03-20T20:16:49+00:00",
      "updated": "2026-04-07T18:40:02+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-44431",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
      },
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        200
      ],
      "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.",
      "recommendation": "Upgrade urllib3 to version 2.7.0",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "url": "https://github.com/urllib3/urllib3"
        },
        {
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8379-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        }
      ],
      "published": "2026-05-13T16:16:57+00:00",
      "updated": "2026-05-14T13:56:27+00:00",
      "affects": [
        {
          "ref": "pkg:pypi/urllib3@2.6.3",
          "versions": [
            {
              "version": "2.6.3",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:pypi/urllib3@2.6.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-44432",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        409
      ],
      "description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.",
      "recommendation": "Upgrade urllib3 to version 2.7.0",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"
        },
        {
          "url": "https://github.com/urllib3/urllib3"
        },
        {
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8379-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        }
      ],
      "published": "2026-05-13T16:16:57+00:00",
      "updated": "2026-05-14T13:49:25+00:00",
      "affects": [
        {
          "ref": "pkg:pypi/urllib3@2.6.3",
          "versions": [
            {
              "version": "2.6.3",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:pypi/urllib3@2.6.3"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:pypi/urllib3@2.6.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-44604",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        78
      ],
      "description": "A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44604"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-44604"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460967"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44604"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44604"
        }
      ],
      "published": "2026-05-28T08:16:35+00:00",
      "updated": "2026-05-28T13:44:54+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.14.3-32.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.14.3-32.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.14.3-32.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.14.3-32.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-44608",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        413
      ],
      "description": "NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44608"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-44608"
        },
        {
          "url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44608"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8282-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44608"
        },
        {
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt"
        }
      ],
      "published": "2026-05-20T10:16:28+00:00",
      "updated": "2026-05-20T22:52:48+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "1.16.2-5.9.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-45186",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        }
      ],
      "cwes": [
        407
      ],
      "description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.",
      "recommendation": "Upgrade expat to version 2.5.0-2.el8_10",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45186"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/05/11/16"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:22721"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-45186"
        },
        {
          "url": "https://bugzilla.redhat.com/2468575"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45186"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-22721.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:22715"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1216"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-45186.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-22721.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45186"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45186"
        }
      ],
      "published": "2026-05-10T07:16:07+00:00",
      "updated": "2026-05-14T17:20:32+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-45409",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
      },
      "ratings": [],
      "cwes": [
        1333
      ],
      "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.",
      "recommendation": "Upgrade idna to version 3.15",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409"
        },
        {
          "url": "https://github.com/kjd/idna"
        },
        {
          "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409"
        }
      ],
      "published": "2026-06-05T23:16:43+00:00",
      "updated": "2026-06-08T15:02:26+00:00",
      "affects": [
        {
          "ref": "pkg:pypi/idna@3.13",
          "versions": [
            {
              "version": "3.13",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:pypi/idna@3.13"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:pypi/idna@3.13"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-4873",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        295,
        319
      ],
      "description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-4873"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/29/7"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-4873"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-4873.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-4873.json"
        },
        {
          "url": "https://hackerone.com/reports/3621851"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4873"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8227-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4873"
        }
      ],
      "published": "2026-05-13T13:01:55+00:00",
      "updated": "2026-05-14T13:45:11+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-48864",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        787
      ],
      "description": "A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-48864"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:21333"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-48864"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
        }
      ],
      "published": "2026-05-26T17:16:54+00:00",
      "updated": "2026-05-28T19:22:42+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.7.20-6.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-50219",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 4.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
        }
      ],
      "cwes": [
        416
      ],
      "description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-50219"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-50219"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1246"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50219"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50219"
        }
      ],
      "published": "2026-06-04T06:16:25+00:00",
      "updated": "2026-06-04T18:39:29+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.5.0-1.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5260",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "oracle-oval"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 8.2,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        1284
      ],
      "description": "A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.",
      "recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5260"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20611"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5260"
        },
        {
          "url": "https://bugzilla.redhat.com/2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.almalinux.org/8/ALSA-2026-20611.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://linux.oracle.com/cve/CVE-2026-5260.html"
        },
        {
          "url": "https://linux.oracle.com/errata/ELSA-2026-20611.html"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5260"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"
        }
      ],
      "published": "2026-05-26T22:16:44+00:00",
      "updated": "2026-06-02T16:16:45+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-5419",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        208
      ],
      "description": "A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5419"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20612"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:20613"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5419"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:20613"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5419"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8284-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5419"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-13"
        }
      ],
      "published": "2026-06-01T21:16:47+00:00",
      "updated": "2026-06-02T17:16:37+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.16-8.el8_10.5",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.5?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5435",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        787
      ],
      "description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5435"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5435"
        },
        {
          "url": "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/"
        },
        {
          "url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5435"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34033"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5435"
        }
      ],
      "published": "2026-04-28T13:19:22+00:00",
      "updated": "2026-05-05T17:38:37+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5450",
      "ratings": [
        {
          "source": {
            "name": "photon"
          },
          "severity": "critical"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H"
        }
      ],
      "cwes": [
        122,
        787
      ],
      "description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5450"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5450"
        },
        {
          "url": "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5450"
        }
      ],
      "published": "2026-04-20T21:16:36+00:00",
      "updated": "2026-04-23T15:33:34+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5545",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        613
      ],
      "description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5545"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5545"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-5545.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-5545.json"
        },
        {
          "url": "https://hackerone.com/reports/3642555"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8227-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5545"
        }
      ],
      "published": "2026-05-13T13:01:56+00:00",
      "updated": "2026-05-13T19:31:07+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5704",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        434
      ],
      "description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5704"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/11/10"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/11/11"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/12/2"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5704"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455360"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5704"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5704"
        }
      ],
      "published": "2026-04-06T16:16:42+00:00",
      "updated": "2026-04-22T20:08:59+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
          "versions": [
            {
              "version": "2:1.30-11.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5713",
      "ratings": [
        {
          "source": {
            "name": "alma"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "rocky"
          },
          "severity": "high"
        }
      ],
      "cwes": [
        121,
        125
      ],
      "description": "The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5713"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/15/6"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:19176"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5713"
        },
        {
          "url": "https://bugzilla.redhat.com/2431367"
        },
        {
          "url": "https://bugzilla.redhat.com/2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/2458239"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458239"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5713"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
        },
        {
          "url": "https://errata.almalinux.org/9/ALSA-2026-19176.html"
        },
        {
          "url": "https://errata.rockylinux.org/RLSA-2026:19019"
        },
        {
          "url": "https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67"
        },
        {
          "url": "https://github.com/python/cpython/issues/148178"
        },
        {
          "url": "https://github.com/python/cpython/pull/148187"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5713"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5713"
        }
      ],
      "published": "2026-04-14T16:16:48+00:00",
      "updated": "2026-04-17T15:11:35+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5745",
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        476
      ],
      "description": "A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5745"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:8944"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5745"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455921"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5745"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5745"
        }
      ],
      "published": "2026-04-07T16:16:32+00:00",
      "updated": "2026-05-03T15:15:58+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.3.3-7.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5773",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        918
      ],
      "description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different 'share' than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5773"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/29/9"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5773"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-5773.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-5773.json"
        },
        {
          "url": "https://hackerone.com/reports/3650689"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5773"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8227-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5773"
        }
      ],
      "published": "2026-05-13T13:01:56+00:00",
      "updated": "2026-05-13T19:13:14+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5928",
      "ratings": [
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H"
        }
      ],
      "cwes": [
        127
      ],
      "description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5928"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5928"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5928"
        }
      ],
      "published": "2026-04-20T21:16:36+00:00",
      "updated": "2026-04-23T15:33:43+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.28-251.el8_10.34",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.34?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5958",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "low"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        367
      ],
      "description": "When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores\u00a0the resolved path for determining when output is written,\n2. opens the original symlink path\u00a0(not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1.\u00a0This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5958"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/05/13/1"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5958"
        },
        {
          "url": "https://cert.pl/en/posts/2026/04/CVE-2026-5958"
        },
        {
          "url": "https://github.com/advisories/GHSA-9r7w-j29g-xqx8"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5958"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8229-1"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8229-2"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5958"
        },
        {
          "url": "https://www.gnu.org/software/sed"
        },
        {
          "url": "https://www.gnu.org/software/sed/"
        }
      ],
      "published": "2026-04-20T12:16:08+00:00",
      "updated": "2026-05-19T15:17:37+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "4.5-5.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-6019",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.1,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
        }
      ],
      "cwes": [
        150,
        116
      ],
      "description": "http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-6019"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-6019"
        },
        {
          "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c"
        },
        {
          "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
        },
        {
          "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8"
        },
        {
          "url": "https://github.com/python/cpython/issues/90309"
        },
        {
          "url": "https://github.com/python/cpython/pull/148848"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6019"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6019"
        }
      ],
      "published": "2026-04-22T20:16:42+00:00",
      "updated": "2026-05-28T19:15:28+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-6253",
      "ratings": [
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        522
      ],
      "description": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-6253"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/29/11"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-6253"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6253.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6253.json"
        },
        {
          "url": "https://hackerone.com/reports/3669637"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8227-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6253"
        }
      ],
      "published": "2026-05-13T13:01:56+00:00",
      "updated": "2026-05-14T13:40:53+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-6276",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "low"
        }
      ],
      "cwes": [
        319
      ],
      "description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-6276"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/29/13"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-6276"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6276.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6276.json"
        },
        {
          "url": "https://hackerone.com/reports/3671818"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6276"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8227-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6276"
        }
      ],
      "published": "2026-05-13T13:01:56+00:00",
      "updated": "2026-05-14T14:21:06+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-6429",
      "ratings": [
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-6429"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-6429"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6429.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6429.json"
        },
        {
          "url": "https://hackerone.com/reports/3677759"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8227-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6429"
        }
      ],
      "published": "2026-05-13T13:01:56+00:00",
      "updated": "2026-05-14T14:18:02+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-6732",
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        843
      ],
      "description": "A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-6732"
        },
        {
          "url": "https://access.redhat.com/errata/RHSA-2026:11503"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-6732"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461300"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6732"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6732"
        }
      ],
      "published": "2026-04-23T23:16:16+00:00",
      "updated": "2026-05-15T14:36:35+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "2.9.7-21.el8_10.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-7168",
      "ratings": [
        {
          "source": {
            "name": "azure"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "photon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        294
      ],
      "description": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-7168"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/29/14"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-7168"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-7168.html"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-7168.json"
        },
        {
          "url": "https://hackerone.com/reports/3697719"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8227-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-7168"
        }
      ],
      "published": "2026-05-13T13:01:57+00:00",
      "updated": "2026-05-14T14:12:48+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "7.61.1-34.el8_10.11",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-7210",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        331
      ],
      "description": "`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-7210"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/05/11/13"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/05/11/8"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-7210"
        },
        {
          "url": "https://github.com/python/cpython/issues/149018"
        },
        {
          "url": "https://github.com/python/cpython/pull/149023"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7210"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-7210"
        }
      ],
      "published": "2026-05-11T18:16:42+00:00",
      "updated": "2026-06-01T14:32:20+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "3.6.8-76.el8_10",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-9149",
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        122
      ],
      "description": "A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-9149"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-9149"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460380"
        },
        {
          "url": "https://github.com/openSUSE/libsolv/pull/617"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9149"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9149"
        }
      ],
      "published": "2026-05-21T00:16:35+00:00",
      "updated": "2026-06-02T01:21:26+00:00",
      "affects": [
        {
          "ref": "pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10",
          "versions": [
            {
              "version": "0.7.20-6.el8",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "GHSA-72hv-8253-57qq",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [],
      "description": "### Summary\nThe non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).\n\nThe standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.\n\n### Details\nThe root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.\n\n- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks.\n- After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`.\n- The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed.\n- Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.\n\n### PoC\nThe following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.\n\n```java\npackage tools.jackson.core.unittest.dos;\n\nimport java.nio.charset.StandardCharsets;\n\nimport org.junit.jupiter.api.Test;\n\nimport tools.jackson.core.*;\nimport tools.jackson.core.exc.StreamConstraintsException;\nimport tools.jackson.core.json.JsonFactory;\nimport tools.jackson.core.json.async.NonBlockingByteArrayJsonParser;\n\nimport static org.junit.jupiter.api.Assertions.*;\n\n/**\n * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers\n *\n * Authors: sprabhav7, rohan-repos\n * \n * maxNumberLength default = 1000 characters (digits).\n * A number with more than 1000 digits should be rejected by any parser.\n *\n * BUG: The async parser never calls resetInt()/resetFloat() which is where\n * validateIntegerLength()/validateFPLength() lives. Instead it calls\n * _valueComplete() which skips all number length validation.\n *\n * CWE-770: Allocation of Resources Without Limits or Throttling\n */\nclass AsyncParserNumberLengthBypassTest {\n\n    private static final int MAX_NUMBER_LENGTH = 1000;\n    private static final int TEST_NUMBER_LENGTH = 5000;\n\n    private final JsonFactory factory = new JsonFactory();\n\n    // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength\n    @Test\n    void syncParserRejectsLongNumber() throws Exception {\n        byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\t\t\n\t\t// Output to console\n        System.out.println(\"[SYNC] Parsing \" + TEST_NUMBER_LENGTH + \"-digit number (limit: \" + MAX_NUMBER_LENGTH + \")\");\n        try {\n            try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) {\n                while (p.nextToken() != null) {\n                    if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n                        System.out.println(\"[SYNC] Accepted number with \" + p.getText().length() + \" digits \u2014 UNEXPECTED\");\n                    }\n                }\n            }\n            fail(\"Sync parser must reject a \" + TEST_NUMBER_LENGTH + \"-digit number\");\n        } catch (StreamConstraintsException e) {\n            System.out.println(\"[SYNC] Rejected with StreamConstraintsException: \" + e.getMessage());\n        }\n    }\n\n    // VULNERABILITY: Async parser accepts the SAME number that sync rejects\n    @Test\n    void asyncParserAcceptsLongNumber() throws Exception {\n        byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\n        NonBlockingByteArrayJsonParser p =\n            (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty());\n        p.feedInput(payload, 0, payload.length);\n        p.endOfInput();\n\n        boolean foundNumber = false;\n        try {\n            while (p.nextToken() != null) {\n                if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n                    foundNumber = true;\n                    String numberText = p.getText();\n                    assertEquals(TEST_NUMBER_LENGTH, numberText.length(),\n                        \"Async parser silently accepted all \" + TEST_NUMBER_LENGTH + \" digits\");\n                }\n            }\n            // Output to console\n            System.out.println(\"[ASYNC INT] Accepted number with \" + TEST_NUMBER_LENGTH + \" digits \u2014 BUG CONFIRMED\");\n            assertTrue(foundNumber, \"Parser should have produced a VALUE_NUMBER_INT token\");\n        } catch (StreamConstraintsException e) {\n            fail(\"Bug is fixed \u2014 async parser now correctly rejects long numbers: \" + e.getMessage());\n        }\n        p.close();\n    }\n\n    private byte[] buildPayloadWithLongInteger(int numDigits) {\n        StringBuilder sb = new StringBuilder(numDigits + 10);\n        sb.append(\"{\\\"v\\\":\");\n        for (int i = 0; i < numDigits; i++) {\n            sb.append((char) ('1' + (i % 9)));\n        }\n        sb.append('}');\n        return sb.toString().getBytes(StandardCharsets.UTF_8);\n    }\n}\n\n```\n\n\n### Impact\nA malicious actor can send a JSON document with an arbitrarily long number to an application using the async parser (e.g., in a Spring WebFlux or other reactive application). This can cause:\n1.  **Memory Exhaustion:** Unbounded allocation of memory in the `TextBuffer` to store the number's digits, leading to an `OutOfMemoryError`.\n2.  **CPU Exhaustion:** If the application subsequently calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM can be tied up in O(n^2) `BigInteger` parsing operations, leading to a CPU-based DoS.\n\n### Suggested Remediation\n\nThe async parsing path should be updated to respect the `maxNumberLength` constraint. The simplest fix appears to ensure that `_valueComplete()` or a similar method in the async path calls the appropriate validation methods (`resetInt()` or `resetFloat()`) already present in `ParserBase`, mirroring the behavior of the synchronous parsers.\n\n**NOTE:** This research was performed in collaboration with [rohan-repos](https://github.com/rohan-repos)",
      "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-core to version 2.21.1, 2.18.6",
      "advisories": [
        {
          "url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core/pull/1555"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq"
        }
      ],
      "published": "2026-02-28T02:01:05+00:00",
      "updated": "2026-04-07T16:30:17+00:00",
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0",
          "versions": [
            {
              "version": "2.16.0",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#66df6a59-a185-432b-87fb-e5cfe9050324"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4ffc7126-4b01-4c3c-a355-47be96102387"
        },
        {
          "ref": "urn:cdx:960aea3a-0994-4d9e-b12a-2f30aaaedfb5/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4d9b740b-0f1a-4077-b7bd-9d12664a3df2"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#35f2879e-3c00-431a-b9ae-46714d9cc383"
        },
        {
          "ref": "urn:cdx:2ec75db1-db24-429d-8d45-3d0b36d0c2af/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#713f2eeb-e074-444a-8cbb-40327412e0b4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#8ca8e216-5e47-4b46-8f75-54ef39019544"
        },
        {
          "ref": "urn:cdx:cefbc5c3-0907-44c6-97f8-32279a670a45/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:22b30f82-02c3-4626-81ba-4390c65d072a/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#13b6a1b3-68b8-4010-9d2b-62c0da1ba43b"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#71807f84-61c1-4c23-b310-8fea7ce12c94"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#04b0d2b8-5f53-4064-896f-946dbb900c72"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1ff25d12-4ce5-4445-8415-6c3a6a65b1bf"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#022501e6-14e5-48e4-8094-c3c4eadafe05"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#35f4f900-ec2a-4587-9039-e8b815a5d762"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#4c3ebd41-a46a-4051-993f-928654b7bee3"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07a64ac0-efee-44ba-9699-5e069d998f7d"
        },
        {
          "ref": "urn:cdx:676500d9-d94e-4600-abca-93379be0b227/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#01134142-8888-4737-b9ee-ab68ea2e3fa0"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#05990903-806a-4a53-ab8f-4a7a35674265"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#1cdafb13-4cbf-4077-ab66-9f09a4d9fcda"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1d8e2b15-1e0e-44fc-b5dd-3521e6cc0e59"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1170eab4-2615-4876-9d36-892200272b51"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#01a8a32a-fdc1-44f6-8e93-6a69d92c5d48"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#1a9e922d-da34-446c-81ab-6cf3fe61ace6"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "This issue is not exploitable in the context of Confluent Platform. The async parser is not used in Confluent Platform components. "
      }
    },
    {
      "id": "CVE-2024-6763",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 3.7,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 3.7,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        1286
      ],
      "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.",
      "recommendation": "Upgrade org.eclipse.jetty:jetty-http to version 12.0.12",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2024-6763"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2024-6763"
        },
        {
          "url": "https://github.com/jetty/jetty.project"
        },
        {
          "url": "https://github.com/jetty/jetty.project/pull/12012"
        },
        {
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh"
        },
        {
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/25"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250306-0005"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20250306-0005/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-6763"
        }
      ],
      "published": "2024-10-14T16:15:04+00:00",
      "updated": "2025-07-10T15:04:04+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.59",
          "versions": [
            {
              "version": "9.4.59",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.59",
          "versions": [
            {
              "version": "9.4.59",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.60",
          "versions": [
            {
              "version": "9.4.60",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#24b01b9e-a0c7-4786-8bdd-dabb36f3ff7c"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#24b01b9e-a0c7-4786-8bdd-dabb36f3ff7c"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:fc5cf0fc-7821-4948-acb8-90606380af97/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#5640dd10-fce4-4f56-b514-5d9a82b993b3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#5640dd10-fce4-4f56-b514-5d9a82b993b3"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#3aeff481-3498-4ff2-b695-0530074dbd9e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#3aeff481-3498-4ff2-b695-0530074dbd9e"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#d57d4a6a-d018-42a1-9dd8-19b0055608a3"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#d57d4a6a-d018-42a1-9dd8-19b0055608a3"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#03b2643a-86a4-4ecb-bf9b-969e458a5ddc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#03b2643a-86a4-4ecb-bf9b-969e458a5ddc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#2c7063f8-2c60-4685-b912-b357b34b0963"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#2c7063f8-2c60-4685-b912-b357b34b0963"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#35833eac-a960-4d83-b81f-91dcefdf2322"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#35833eac-a960-4d83-b81f-91dcefdf2322"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#27ae3399-aedf-49a7-9c40-68d1c3b8bf46"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#27ae3399-aedf-49a7-9c40-68d1c3b8bf46"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#125adb0a-c3d2-4293-8859-663f00e7ad26"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#125adb0a-c3d2-4293-8859-663f00e7ad26"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#244e290d-5c28-4cc8-8491-c92604b91393"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#244e290d-5c28-4cc8-8491-c92604b91393"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#27e70e60-71a7-44a8-b043-edf01d9eef81"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#27e70e60-71a7-44a8-b043-edf01d9eef81"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#437d8fc4-a6ae-43a6-acef-abfbdcee99f0"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#437d8fc4-a6ae-43a6-acef-abfbdcee99f0"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#13a2cd5d-5da2-4ec4-b6f0-6d9ef267f350"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#13a2cd5d-5da2-4ec4-b6f0-6d9ef267f350"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#06f67d7a-514b-473a-bf04-8863cb20b709"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#06f67d7a-514b-473a-bf04-8863cb20b709"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#4061a4b0-9e24-4c31-af91-08ac17a7d950"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#4061a4b0-9e24-4c31-af91-08ac17a7d950"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "This vulnerability is not exploitable in the context of Confluent Platform as URIs are not used to pass sensitive information. "
      }
    },
    {
      "id": "CVE-2025-67030",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "azure"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "cbl-mariner"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "ghsa"
          },
          "severity": "high"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 8.8,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 8.3,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
        }
      ],
      "cwes": [
        22
      ],
      "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code",
      "recommendation": "Upgrade org.codehaus.plexus:plexus-utils to version 4.0.3, 3.6.1",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2025-67030"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-67030"
        },
        {
          "url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
        },
        {
          "url": "https://github.com/codehaus-plexus/plexus-utils"
        },
        {
          "url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
        },
        {
          "url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
        },
        {
          "url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
        },
        {
          "url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
        },
        {
          "url": "https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
        }
      ],
      "published": "2026-03-25T18:16:25+00:00",
      "updated": "2026-05-01T17:12:22+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1",
          "versions": [
            {
              "version": "3.3.1",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1",
          "versions": [
            {
              "version": "3.3.1",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#a0df4615-b73a-4719-863a-cd5444a98003"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#a0df4615-b73a-4719-863a-cd5444a98003"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#40e22f61-0c74-41cf-9b7e-316dd6424c9e"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#40e22f61-0c74-41cf-9b7e-316dd6424c9e"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3f2a1b5a-4028-4c2f-b050-45c78bf0fa16"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3f2a1b5a-4028-4c2f-b050-45c78bf0fa16"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#863bf75d-7d8f-4d3c-9a19-3bb92c74835d"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#863bf75d-7d8f-4d3c-9a19-3bb92c74835d"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4356bc6b-2faa-4801-8d61-6430d297d09a"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4356bc6b-2faa-4801-8d61-6430d297d09a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#02fabfba-2488-49bd-b357-aaef4e568abe"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#02fabfba-2488-49bd-b357-aaef4e568abe"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#093d48e4-9c23-44f8-a277-2d851ab4a59c"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#093d48e4-9c23-44f8-a277-2d851ab4a59c"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#3d8d72a5-477e-44af-8ee5-1453dc9cdd4f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#3d8d72a5-477e-44af-8ee5-1453dc9cdd4f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#503515ca-4e40-47da-a28b-6ed45f96d319"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#503515ca-4e40-47da-a28b-6ed45f96d319"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#19640ecf-47c8-4ff7-9612-7595770cab47"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#19640ecf-47c8-4ff7-9612-7595770cab47"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#07d7ca2a-732f-43ac-bf0d-b89e7df39a34"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#07d7ca2a-732f-43ac-bf0d-b89e7df39a34"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0d52b29e-a6c1-4631-8bd3-ac4af3f17241"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0d52b29e-a6c1-4631-8bd3-ac4af3f17241"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#54a894e0-1053-4630-a604-b20f6ee1670a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#54a894e0-1053-4630-a604-b20f6ee1670a"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#3299821d-18f5-45e1-adc3-73cb7f9da0f9"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#3299821d-18f5-45e1-adc3-73cb7f9da0f9"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#27ecd55a-e4b6-474b-b161-a807c0d884ac"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#27ecd55a-e4b6-474b-b161-a807c0d884ac"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#26560486-bb1b-41ce-9d34-b95adea11252"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#26560486-bb1b-41ce-9d34-b95adea11252"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-2332",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.1,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "cwes": [
        444
      ],
      "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at\u00a0\\r\\n\u00a0inside quoted strings instead of treating this as an error.\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.",
      "recommendation": "Upgrade org.eclipse.jetty:jetty-http to version 12.1.7, 12.0.33",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-2332"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-2332"
        },
        {
          "url": "https://github.com/jetty/jetty.project"
        },
        {
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
        },
        {
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
        },
        {
          "url": "https://w4ke.info/2025/06/18/funky-chunks.html"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
        }
      ],
      "published": "2026-04-14T12:16:21+00:00",
      "updated": "2026-05-01T13:31:00+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.59",
          "versions": [
            {
              "version": "9.4.59",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.59",
          "versions": [
            {
              "version": "9.4.59",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#24b01b9e-a0c7-4786-8bdd-dabb36f3ff7c"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#24b01b9e-a0c7-4786-8bdd-dabb36f3ff7c"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#5640dd10-fce4-4f56-b514-5d9a82b993b3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#5640dd10-fce4-4f56-b514-5d9a82b993b3"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#3aeff481-3498-4ff2-b695-0530074dbd9e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#3aeff481-3498-4ff2-b695-0530074dbd9e"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#d57d4a6a-d018-42a1-9dd8-19b0055608a3"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#d57d4a6a-d018-42a1-9dd8-19b0055608a3"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#03b2643a-86a4-4ecb-bf9b-969e458a5ddc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#03b2643a-86a4-4ecb-bf9b-969e458a5ddc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#2c7063f8-2c60-4685-b912-b357b34b0963"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#2c7063f8-2c60-4685-b912-b357b34b0963"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#35833eac-a960-4d83-b81f-91dcefdf2322"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#35833eac-a960-4d83-b81f-91dcefdf2322"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#27ae3399-aedf-49a7-9c40-68d1c3b8bf46"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#27ae3399-aedf-49a7-9c40-68d1c3b8bf46"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#125adb0a-c3d2-4293-8859-663f00e7ad26"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#125adb0a-c3d2-4293-8859-663f00e7ad26"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#244e290d-5c28-4cc8-8491-c92604b91393"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#244e290d-5c28-4cc8-8491-c92604b91393"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#27e70e60-71a7-44a8-b043-edf01d9eef81"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#27e70e60-71a7-44a8-b043-edf01d9eef81"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#437d8fc4-a6ae-43a6-acef-abfbdcee99f0"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#437d8fc4-a6ae-43a6-acef-abfbdcee99f0"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#13a2cd5d-5da2-4ec4-b6f0-6d9ef267f350"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#13a2cd5d-5da2-4ec4-b6f0-6d9ef267f350"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#06f67d7a-514b-473a-bf04-8863cb20b709"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#06f67d7a-514b-473a-bf04-8863cb20b709"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#4061a4b0-9e24-4c31-af91-08ac17a7d950"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#4061a4b0-9e24-4c31-af91-08ac17a7d950"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "protected_at_runtime",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-33870",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "cwes": [
        444
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.",
      "recommendation": "Upgrade io.netty:netty-codec-http to version 4.1.132.Final, 4.2.10.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-33870"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-33870"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
        },
        {
          "url": "https://w4ke.info/2025/06/18/funky-chunks.html"
        },
        {
          "url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
        },
        {
          "url": "https://www.rfc-editor.org/rfc/rfc9110"
        }
      ],
      "published": "2026-03-27T20:16:34+00:00",
      "updated": "2026-03-30T20:12:16+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "protected_at_runtime",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-33871",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        770
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.",
      "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.1.132.Final, 4.2.11.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-33871"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-33871"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
        }
      ],
      "published": "2026-03-27T20:16:34+00:00",
      "updated": "2026-03-30T20:10:17+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#709830ae-9af6-4db2-a3d1-298ef59d7df3"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#709830ae-9af6-4db2-a3d1-298ef59d7df3"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#7ad5921a-8236-41c9-82f9-57e26f88aba4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#7ad5921a-8236-41c9-82f9-57e26f88aba4"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8853b998-b2fe-4016-a2a3-c102c8a06c65"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8853b998-b2fe-4016-a2a3-c102c8a06c65"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#23013092-4ff3-46c8-837e-8a85e8a2ef5e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#23013092-4ff3-46c8-837e-8a85e8a2ef5e"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#057e3949-6862-4ad3-a797-9b72134e4f0b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#057e3949-6862-4ad3-a797-9b72134e4f0b"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#2b02b850-0f21-4942-908e-9e88849d337f"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#2b02b850-0f21-4942-908e-9e88849d337f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#173f2853-5eff-440e-9718-b743a4c7bc6f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#173f2853-5eff-440e-9718-b743a4c7bc6f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1d4c097d-034f-4081-b9b7-931613cc14d2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1d4c097d-034f-4081-b9b7-931613cc14d2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#701bbf52-9fc9-4054-b3e2-b3355713804a"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#701bbf52-9fc9-4054-b3e2-b3355713804a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#5346ff76-2aff-4d62-9675-a959f5b38a9a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#5346ff76-2aff-4d62-9675-a959f5b38a9a"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#642b2d00-187e-4209-94fd-12eecaf9e384"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#642b2d00-187e-4209-94fd-12eecaf9e384"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#36fdba8b-d76e-4ba6-8771-7dfcd2d825c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#36fdba8b-d76e-4ba6-8771-7dfcd2d825c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#09f83b07-35d1-4211-a43a-df5c80ad3962"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#09f83b07-35d1-4211-a43a-df5c80ad3962"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#07789c81-94f8-4d8d-b484-57cbd3079c69"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#07789c81-94f8-4d8d-b484-57cbd3079c69"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#19c5a50b-3df4-4b68-b3ff-05830b83c82d"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#19c5a50b-3df4-4b68-b3ff-05830b83c82d"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6c8a6e01-3d5c-4f9c-b1c7-04180b4274da"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6c8a6e01-3d5c-4f9c-b1c7-04180b4274da"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-40490",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
        }
      ],
      "cwes": [
        200
      ],
      "description": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation.",
      "recommendation": "Upgrade org.asynchttpclient:async-http-client to version 3.0.9, 2.14.5",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-40490"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-40490"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40490"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40490"
        }
      ],
      "published": "2026-04-18T02:16:11+00:00",
      "updated": "2026-04-20T18:59:16+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.4",
          "versions": [
            {
              "version": "2.12.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.4",
          "versions": [
            {
              "version": "2.12.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.4",
          "versions": [
            {
              "version": "2.12.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#7a2400b7-7c0f-4228-bcb3-3a8f7023e572"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#7a2400b7-7c0f-4228-bcb3-3a8f7023e572"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#7a2400b7-7c0f-4228-bcb3-3a8f7023e572"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0674a596-912a-4ca2-b3ba-d8a4fb8a673a"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0674a596-912a-4ca2-b3ba-d8a4fb8a673a"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0674a596-912a-4ca2-b3ba-d8a4fb8a673a"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4ee304db-a22e-4e61-bbea-2a3cd7012761"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4ee304db-a22e-4e61-bbea-2a3cd7012761"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4ee304db-a22e-4e61-bbea-2a3cd7012761"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7bf210cf-ecce-4fa8-830d-4fcb9e996e0f"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7bf210cf-ecce-4fa8-830d-4fcb9e996e0f"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7bf210cf-ecce-4fa8-830d-4fcb9e996e0f"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46a4e722-4119-4a17-82d9-9326fac8ee5b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46a4e722-4119-4a17-82d9-9326fac8ee5b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46a4e722-4119-4a17-82d9-9326fac8ee5b"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#06221ded-8c14-488f-8277-4512ca5a8c98"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#06221ded-8c14-488f-8277-4512ca5a8c98"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#06221ded-8c14-488f-8277-4512ca5a8c98"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1f159064-fabc-4b52-b52c-8577659eac93"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1f159064-fabc-4b52-b52c-8577659eac93"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1f159064-fabc-4b52-b52c-8577659eac93"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1fea405d-404f-42c2-9885-fb95b3d34b07"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1fea405d-404f-42c2-9885-fb95b3d34b07"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1fea405d-404f-42c2-9885-fb95b3d34b07"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#69f7dd1f-5207-4bbb-8b26-b6c6bf1b5974"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#69f7dd1f-5207-4bbb-8b26-b6c6bf1b5974"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#69f7dd1f-5207-4bbb-8b26-b6c6bf1b5974"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#06d39c74-bdfe-44d0-a1cd-9a8ae90bd9d4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#06d39c74-bdfe-44d0-a1cd-9a8ae90bd9d4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#06d39c74-bdfe-44d0-a1cd-9a8ae90bd9d4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#51eab3bf-fb80-40cb-ab06-568e421fc979"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#51eab3bf-fb80-40cb-ab06-568e421fc979"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#51eab3bf-fb80-40cb-ab06-568e421fc979"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#08c8ff80-bbeb-4f94-a27e-6cc45337d92b"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#08c8ff80-bbeb-4f94-a27e-6cc45337d92b"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#08c8ff80-bbeb-4f94-a27e-6cc45337d92b"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2cf4cc34-0874-42ef-8ca9-5095cd2aff23"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2cf4cc34-0874-42ef-8ca9-5095cd2aff23"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2cf4cc34-0874-42ef-8ca9-5095cd2aff23"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0067a2d8-71f7-48ab-9319-4d0ad699206c"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0067a2d8-71f7-48ab-9319-4d0ad699206c"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0067a2d8-71f7-48ab-9319-4d0ad699206c"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#45e73d3f-0465-428a-b43b-2b246081bd76"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#45e73d3f-0465-428a-b43b-2b246081bd76"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#45e73d3f-0465-428a-b43b-2b246081bd76"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#67db38c1-a195-45c1-9935-d7ffcfdb214f"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#67db38c1-a195-45c1-9935-d7ffcfdb214f"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#67db38c1-a195-45c1-9935-d7ffcfdb214f"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-41409",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 9.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        502
      ],
      "description": "The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.\n\n\n\n\nThe problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade",
      "recommendation": "Upgrade org.apache.mina:mina-core to version 2.0.28, 2.1.11, 2.2.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-41409"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-41409"
        },
        {
          "url": "https://github.com/advisories/GHSA-76h9-2vwh-w278"
        },
        {
          "url": "https://github.com/apache/mina"
        },
        {
          "url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
        }
      ],
      "published": "2026-04-27T10:16:09+00:00",
      "updated": "2026-04-29T19:08:07+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.0.27",
          "versions": [
            {
              "version": "2.0.27",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-41417",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "cwes": [
        93,
        444
      ],
      "description": "Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-http to version 4.1.133.Final, 4.2.13.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-41417"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-41417"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41417"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41417"
        }
      ],
      "published": "2026-05-06T22:16:25+00:00",
      "updated": "2026-05-11T14:29:48+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-41635",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 9.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        502
      ],
      "description": "Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.\n\n\n\n\nThe fix checks if the class is present in the accepted class filter\u00a0before calling\u00a0Class.forName().\u00a0\n\n\n\n\n\n\nAffected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and\n\n\n2.2.0 <= 2.2.5.\n\n\n\n\n\nThe problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by \napplying the classname allowlist earlier.\n\n\n\n\n\nAffected are applications using Apache MINA that call\u00a0 IoBuffer.getObject().\n\n\n\n\n\nApplications using Apache MINA are advised to upgrade.",
      "recommendation": "Upgrade org.apache.mina:mina-core to version 2.0.28, 2.1.11, 2.2.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-41635"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/04/27/4"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-41635"
        },
        {
          "url": "https://github.com/apache/mina"
        },
        {
          "url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
        }
      ],
      "published": "2026-04-27T09:16:01+00:00",
      "updated": "2026-04-29T19:08:21+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.0.27",
          "versions": [
            {
              "version": "2.0.27",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:maven/org.apache.mina/mina-core@2.0.27"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-42578",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        113
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-handler-proxy to version 4.1.133.Final, 4.2.13.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42578"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42578"
        },
        {
          "url": "https://github.com/advisories/GHSA-84h7-rjj3-6jx4"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8401-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
        }
      ],
      "published": "2026-05-13T19:17:23+00:00",
      "updated": "2026-05-18T12:54:04+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0d9bd854-2df4-489f-8a99-c27aa036b4a6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0d9bd854-2df4-489f-8a99-c27aa036b4a6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0d9bd854-2df4-489f-8a99-c27aa036b4a6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0d9bd854-2df4-489f-8a99-c27aa036b4a6"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#588aa062-00c8-40e6-af69-4a0a31a53db6"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#588aa062-00c8-40e6-af69-4a0a31a53db6"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#588aa062-00c8-40e6-af69-4a0a31a53db6"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#588aa062-00c8-40e6-af69-4a0a31a53db6"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#1b41f994-8796-4920-a15f-55615e47cd5e"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#1b41f994-8796-4920-a15f-55615e47cd5e"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#1b41f994-8796-4920-a15f-55615e47cd5e"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#1b41f994-8796-4920-a15f-55615e47cd5e"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#2e04fb15-cc2b-4e31-affd-548e4b8e224d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#2e04fb15-cc2b-4e31-affd-548e4b8e224d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#2e04fb15-cc2b-4e31-affd-548e4b8e224d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#2e04fb15-cc2b-4e31-affd-548e4b8e224d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#589e291f-34e1-426f-89cd-a4ca5ebb26c9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#589e291f-34e1-426f-89cd-a4ca5ebb26c9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#589e291f-34e1-426f-89cd-a4ca5ebb26c9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#589e291f-34e1-426f-89cd-a4ca5ebb26c9"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#10c7252b-f790-4a76-acfb-26dd00e84587"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#10c7252b-f790-4a76-acfb-26dd00e84587"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#10c7252b-f790-4a76-acfb-26dd00e84587"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#10c7252b-f790-4a76-acfb-26dd00e84587"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7d529b26-6faa-44a5-8fd6-b2e4f7335e3e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7d529b26-6faa-44a5-8fd6-b2e4f7335e3e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7d529b26-6faa-44a5-8fd6-b2e4f7335e3e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7d529b26-6faa-44a5-8fd6-b2e4f7335e3e"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#62de4899-897e-41e1-9277-e8ab26dfcdee"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#62de4899-897e-41e1-9277-e8ab26dfcdee"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#62de4899-897e-41e1-9277-e8ab26dfcdee"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#62de4899-897e-41e1-9277-e8ab26dfcdee"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler-proxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#0e879409-fc40-4837-94a8-26637f4aa2c5"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#0e879409-fc40-4837-94a8-26637f4aa2c5"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#0e879409-fc40-4837-94a8-26637f4aa2c5"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#0e879409-fc40-4837-94a8-26637f4aa2c5"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#8b30dd87-d641-439a-97b5-eb909c1f98ef"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#8b30dd87-d641-439a-97b5-eb909c1f98ef"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#8b30dd87-d641-439a-97b5-eb909c1f98ef"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#8b30dd87-d641-439a-97b5-eb909c1f98ef"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#025ef6a2-13a5-4884-ad09-a3a772a8c45c"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#025ef6a2-13a5-4884-ad09-a3a772a8c45c"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#025ef6a2-13a5-4884-ad09-a3a772a8c45c"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#025ef6a2-13a5-4884-ad09-a3a772a8c45c"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1837d71e-efa7-47b9-aee1-2665da455fd0"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1837d71e-efa7-47b9-aee1-2665da455fd0"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1837d71e-efa7-47b9-aee1-2665da455fd0"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1837d71e-efa7-47b9-aee1-2665da455fd0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1ca108a2-6804-4de6-bbce-76ec3bb6e1a7"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1ca108a2-6804-4de6-bbce-76ec3bb6e1a7"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1ca108a2-6804-4de6-bbce-76ec3bb6e1a7"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1ca108a2-6804-4de6-bbce-76ec3bb6e1a7"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#309d7dcc-26cf-496b-8f47-49cf52192ee4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#309d7dcc-26cf-496b-8f47-49cf52192ee4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#309d7dcc-26cf-496b-8f47-49cf52192ee4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#309d7dcc-26cf-496b-8f47-49cf52192ee4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#32e15008-10cc-4e5a-b706-4eb05499683f"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#32e15008-10cc-4e5a-b706-4eb05499683f"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#32e15008-10cc-4e5a-b706-4eb05499683f"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#32e15008-10cc-4e5a-b706-4eb05499683f"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10b99fc9-d6b9-4dc8-a710-53c67b2d3f39"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10b99fc9-d6b9-4dc8-a710-53c67b2d3f39"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10b99fc9-d6b9-4dc8-a710-53c67b2d3f39"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10b99fc9-d6b9-4dc8-a710-53c67b2d3f39"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#77a41470-484a-490f-b06d-835c13006895"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#77a41470-484a-490f-b06d-835c13006895"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#77a41470-484a-490f-b06d-835c13006895"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#77a41470-484a-490f-b06d-835c13006895"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#19effd6c-a387-4df8-9e5f-e9c04392d7fc"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#19effd6c-a387-4df8-9e5f-e9c04392d7fc"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#19effd6c-a387-4df8-9e5f-e9c04392d7fc"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#19effd6c-a387-4df8-9e5f-e9c04392d7fc"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2a92250e-720f-4f46-9329-05863c043ab7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2a92250e-720f-4f46-9329-05863c043ab7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2a92250e-720f-4f46-9329-05863c043ab7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2a92250e-720f-4f46-9329-05863c043ab7"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#0640a016-435c-4169-8a16-b86bb21d7076"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#0640a016-435c-4169-8a16-b86bb21d7076"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#0640a016-435c-4169-8a16-b86bb21d7076"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#0640a016-435c-4169-8a16-b86bb21d7076"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#2e0898e3-9c1b-45a5-81a9-f05d5c41485f"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#2e0898e3-9c1b-45a5-81a9-f05d5c41485f"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#2e0898e3-9c1b-45a5-81a9-f05d5c41485f"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#2e0898e3-9c1b-45a5-81a9-f05d5c41485f"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#069af840-1c26-40ec-9a31-1292a278706f"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#069af840-1c26-40ec-9a31-1292a278706f"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#069af840-1c26-40ec-9a31-1292a278706f"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#069af840-1c26-40ec-9a31-1292a278706f"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08f4c1cf-dbea-4e26-ac45-c5b591a7d6d0"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08f4c1cf-dbea-4e26-ac45-c5b591a7d6d0"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08f4c1cf-dbea-4e26-ac45-c5b591a7d6d0"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08f4c1cf-dbea-4e26-ac45-c5b591a7d6d0"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42579",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.1,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        20,
        400,
        626
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-dns to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42579"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42579"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
        },
        {
          "url": "https://tools.ietf.org/html/rfc1035#section-2.3.4"
        },
        {
          "url": "https://tools.ietf.org/html/rfc1035#section-4.1.4"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8401-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
        }
      ],
      "published": "2026-05-13T19:17:23+00:00",
      "updated": "2026-05-18T17:16:32+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#14fefdc4-530d-4a4d-81c8-526c8ea2ac72"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#14fefdc4-530d-4a4d-81c8-526c8ea2ac72"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5606669e-a99d-4bea-ba05-675d14beba1a"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5606669e-a99d-4bea-ba05-675d14beba1a"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8e02ef58-db43-46b8-b217-e7e399bd348d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8e02ef58-db43-46b8-b217-e7e399bd348d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#548160b9-c13f-48a6-82ed-b77973cddc4f"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#548160b9-c13f-48a6-82ed-b77973cddc4f"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#45c07c36-4c77-4f3d-8140-6f77d5980fe9"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#45c07c36-4c77-4f3d-8140-6f77d5980fe9"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#25b259ee-e0e9-41d5-867b-c4cad332daa5"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#25b259ee-e0e9-41d5-867b-c4cad332daa5"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0c7b81e6-f845-4a01-889f-b9b6f2b299b8"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0c7b81e6-f845-4a01-889f-b9b6f2b299b8"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#5823d6f0-ec0c-484e-b9fc-8a5627d25c51"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#5823d6f0-ec0c-484e-b9fc-8a5627d25c51"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#14ea363f-75b5-4f5a-b80f-f1235a1a5d6b"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#14ea363f-75b5-4f5a-b80f-f1235a1a5d6b"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#44479d6f-f27a-4421-9a6e-e36161d646c7"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#44479d6f-f27a-4421-9a6e-e36161d646c7"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3c7a75e5-0eae-4e8d-9b6f-3e2012b73245"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3c7a75e5-0eae-4e8d-9b6f-3e2012b73245"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#1d2067ab-a6ab-458f-95ab-d22c7cedfb7c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#1d2067ab-a6ab-458f-95ab-d22c7cedfb7c"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3914a696-bf24-4a6a-ae60-c7d10fcb10dd"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3914a696-bf24-4a6a-ae60-c7d10fcb10dd"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0a69884f-e064-461c-bd36-062406c0b18d"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0a69884f-e064-461c-bd36-062406c0b18d"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#3cbc5db7-e145-4efb-99b2-e1a619e90094"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#3cbc5db7-e145-4efb-99b2-e1a619e90094"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#48aab9ec-c61d-4306-a93f-7b83612aec30"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#48aab9ec-c61d-4306-a93f-7b83612aec30"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42580",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "cwes": [
        190,
        444
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42580"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42580"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42580"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42580"
        }
      ],
      "published": "2026-05-13T19:17:23+00:00",
      "updated": "2026-05-18T14:03:25+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42581",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.2,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        444
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42581"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42581"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8401-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
        }
      ],
      "published": "2026-05-13T19:17:23+00:00",
      "updated": "2026-05-18T13:14:18+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42583",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        400,
        770
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec to version 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42583"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583"
        }
      ],
      "published": "2026-05-13T19:17:23+00:00",
      "updated": "2026-05-18T12:22:15+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec@4.1.132.Final",
          "versions": [
            {
              "version": "4.1.132.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#29de3750-685b-40e5-a897-bb3cce3a033f"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#29de3750-685b-40e5-a897-bb3cce3a033f"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#29de3750-685b-40e5-a897-bb3cce3a033f"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#29de3750-685b-40e5-a897-bb3cce3a033f"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#0e562688-8fff-4a3d-9918-132058187551"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#0e562688-8fff-4a3d-9918-132058187551"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#0e562688-8fff-4a3d-9918-132058187551"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#0e562688-8fff-4a3d-9918-132058187551"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5d47faa9-9ec5-47ae-87e9-a399b3b73efa"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5d47faa9-9ec5-47ae-87e9-a399b3b73efa"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5d47faa9-9ec5-47ae-87e9-a399b3b73efa"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5d47faa9-9ec5-47ae-87e9-a399b3b73efa"
        },
        {
          "ref": "urn:cdx:fc5cf0fc-7821-4948-acb8-90606380af97/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6a6428e9-9e91-4454-9678-3e371fdbe584"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6a6428e9-9e91-4454-9678-3e371fdbe584"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6a6428e9-9e91-4454-9678-3e371fdbe584"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6a6428e9-9e91-4454-9678-3e371fdbe584"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#3d78b3c6-b05e-48a8-8528-f6f692bc8c13"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#3d78b3c6-b05e-48a8-8528-f6f692bc8c13"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#3d78b3c6-b05e-48a8-8528-f6f692bc8c13"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#3d78b3c6-b05e-48a8-8528-f6f692bc8c13"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#8efdb4f0-ae08-4d55-a12a-fd9d73dc6df6"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#8efdb4f0-ae08-4d55-a12a-fd9d73dc6df6"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#8efdb4f0-ae08-4d55-a12a-fd9d73dc6df6"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#8efdb4f0-ae08-4d55-a12a-fd9d73dc6df6"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#5d9794a6-1ab0-4121-99bb-6621f6115f04"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#5d9794a6-1ab0-4121-99bb-6621f6115f04"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#5d9794a6-1ab0-4121-99bb-6621f6115f04"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#5d9794a6-1ab0-4121-99bb-6621f6115f04"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#6d388153-cb59-4bf8-873e-07d6b9410c1a"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#6d388153-cb59-4bf8-873e-07d6b9410c1a"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#6d388153-cb59-4bf8-873e-07d6b9410c1a"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#6d388153-cb59-4bf8-873e-07d6b9410c1a"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-codec@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#1d8ebea6-91d4-4cd6-a223-90af91436184"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#1d8ebea6-91d4-4cd6-a223-90af91436184"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#1d8ebea6-91d4-4cd6-a223-90af91436184"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#1d8ebea6-91d4-4cd6-a223-90af91436184"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#15429fce-c915-433a-a0fe-8f94b0029b42"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#15429fce-c915-433a-a0fe-8f94b0029b42"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#15429fce-c915-433a-a0fe-8f94b0029b42"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#15429fce-c915-433a-a0fe-8f94b0029b42"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0b53b8af-932b-49e1-8831-9591c673174e"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0b53b8af-932b-49e1-8831-9591c673174e"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0b53b8af-932b-49e1-8831-9591c673174e"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0b53b8af-932b-49e1-8831-9591c673174e"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#225ee030-1a25-4fac-bbd8-3f30f4804c5f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#225ee030-1a25-4fac-bbd8-3f30f4804c5f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#225ee030-1a25-4fac-bbd8-3f30f4804c5f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#225ee030-1a25-4fac-bbd8-3f30f4804c5f"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#345f7f6c-e4f5-4fb2-add8-2b8f5e956017"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#345f7f6c-e4f5-4fb2-add8-2b8f5e956017"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#345f7f6c-e4f5-4fb2-add8-2b8f5e956017"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#345f7f6c-e4f5-4fb2-add8-2b8f5e956017"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#02cce744-2d23-4050-ab84-720e23cfbbb8"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#02cce744-2d23-4050-ab84-720e23cfbbb8"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#02cce744-2d23-4050-ab84-720e23cfbbb8"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#02cce744-2d23-4050-ab84-720e23cfbbb8"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#96614fea-699d-4b8b-81d6-c0b89657c323"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#96614fea-699d-4b8b-81d6-c0b89657c323"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#96614fea-699d-4b8b-81d6-c0b89657c323"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#96614fea-699d-4b8b-81d6-c0b89657c323"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#11e38f71-7824-41b1-9f50-d826d45b5177"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#11e38f71-7824-41b1-9f50-d826d45b5177"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#11e38f71-7824-41b1-9f50-d826d45b5177"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#11e38f71-7824-41b1-9f50-d826d45b5177"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#11458553-8ee9-4b6e-9100-9ed8c4826a17"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#11458553-8ee9-4b6e-9100-9ed8c4826a17"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#11458553-8ee9-4b6e-9100-9ed8c4826a17"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#11458553-8ee9-4b6e-9100-9ed8c4826a17"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3a957225-077f-4ecc-ae25-86ab47532e95"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3a957225-077f-4ecc-ae25-86ab47532e95"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3a957225-077f-4ecc-ae25-86ab47532e95"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3a957225-077f-4ecc-ae25-86ab47532e95"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#084b6a2e-a4c8-499a-a41f-2f9f38447095"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#084b6a2e-a4c8-499a-a41f-2f9f38447095"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#084b6a2e-a4c8-499a-a41f-2f9f38447095"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#084b6a2e-a4c8-499a-a41f-2f9f38447095"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#240dbee6-3f0e-4e59-b7da-cb6d3a4371f2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#240dbee6-3f0e-4e59-b7da-cb6d3a4371f2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#240dbee6-3f0e-4e59-b7da-cb6d3a4371f2"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#240dbee6-3f0e-4e59-b7da-cb6d3a4371f2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1655a61f-1583-4a22-8037-c533820ec194"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1655a61f-1583-4a22-8037-c533820ec194"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1655a61f-1583-4a22-8037-c533820ec194"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1655a61f-1583-4a22-8037-c533820ec194"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#13143d03-7686-45aa-8ea0-138aefbd92f4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#13143d03-7686-45aa-8ea0-138aefbd92f4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#13143d03-7686-45aa-8ea0-138aefbd92f4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#13143d03-7686-45aa-8ea0-138aefbd92f4"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/io.netty/netty-codec@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#14c987e6-5569-4d1e-abbb-8efe2fefb818"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#14c987e6-5569-4d1e-abbb-8efe2fefb818"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#14c987e6-5569-4d1e-abbb-8efe2fefb818"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#14c987e6-5569-4d1e-abbb-8efe2fefb818"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42584",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.3,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 9.1,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.3,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        444
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message\u2019s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42584"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42584"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8401-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
        }
      ],
      "published": "2026-05-13T19:17:24+00:00",
      "updated": "2026-05-18T12:15:02+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42585",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        444
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42585"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42585"
        },
        {
          "url": "https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8401-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42585"
        }
      ],
      "published": "2026-05-13T19:17:24+00:00",
      "updated": "2026-05-18T12:24:23+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42586",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.1,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
        },
        {
          "source": {
            "name": "ubuntu"
          },
          "severity": "medium"
        }
      ],
      "cwes": [
        93
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\\r\\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-redis to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42586"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42586"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-rgrr-p7gp-5xj7"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42586"
        },
        {
          "url": "https://redis.io/docs/reference/protocol-spec"
        },
        {
          "url": "https://ubuntu.com/security/notices/USN-8401-1"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42586"
        }
      ],
      "published": "2026-05-13T19:17:24+00:00",
      "updated": "2026-05-18T18:02:43+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-redis@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-redis@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0e28ed06-0913-4c64-a513-692392c9e39b"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0e28ed06-0913-4c64-a513-692392c9e39b"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#871937ab-c02c-4335-ab93-55e47a79fc2d"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#871937ab-c02c-4335-ab93-55e47a79fc2d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#246d4607-adad-41d4-a495-6fb7b90c1ac7"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#246d4607-adad-41d4-a495-6fb7b90c1ac7"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#6a5f6ef8-37ca-461a-bb38-392ac1f5d3e3"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#6a5f6ef8-37ca-461a-bb38-392ac1f5d3e3"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4e0bdb1f-c8e9-4af3-9115-322e304bffa3"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4e0bdb1f-c8e9-4af3-9115-322e304bffa3"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1939bb13-59d1-42b8-a124-f35332a47297"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1939bb13-59d1-42b8-a124-f35332a47297"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#5534c6ff-3a8f-4950-acf5-877804b24b33"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#5534c6ff-3a8f-4950-acf5-877804b24b33"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#2806b977-f338-4d64-8e9a-6bc332e80763"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#2806b977-f338-4d64-8e9a-6bc332e80763"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#60e9e636-6107-4ba5-93cc-08ffd9940b2c"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#60e9e636-6107-4ba5-93cc-08ffd9940b2c"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#53876b0a-0f92-443c-a9f4-5af8e927fb66"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#53876b0a-0f92-443c-a9f4-5af8e927fb66"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#de2a541b-327c-46b4-8eef-37e2a3475a18"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#de2a541b-327c-46b4-8eef-37e2a3475a18"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0e22540f-dfdd-4e68-a83e-83311ec28c08"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0e22540f-dfdd-4e68-a83e-83311ec28c08"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2e347b2c-8881-4159-b1ec-b6f4b4fd391d"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2e347b2c-8881-4159-b1ec-b6f4b4fd391d"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e311648-3aad-4dce-8473-92498412e23f"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e311648-3aad-4dce-8473-92498412e23f"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#143657b4-6c4b-49f3-b372-f91752cf27b4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#143657b4-6c4b-49f3-b372-f91752cf27b4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08fe99ae-ae31-4da3-9054-b9e1eca728b6"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08fe99ae-ae31-4da3-9054-b9e1eca728b6"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42587",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        400
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.13.Final, 4.1.133.Final; Upgrade io.netty:netty-codec-http2 to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42587"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42587"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
        }
      ],
      "published": "2026-05-13T19:17:24+00:00",
      "updated": "2026-05-18T12:20:06+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#709830ae-9af6-4db2-a3d1-298ef59d7df3"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#709830ae-9af6-4db2-a3d1-298ef59d7df3"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#04cb9beb-acb8-45d8-85c6-54663edb2e92"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#099fac9d-efc2-4eb5-b424-e41f8f59b684"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#7ad5921a-8236-41c9-82f9-57e26f88aba4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#7ad5921a-8236-41c9-82f9-57e26f88aba4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#68c31e6c-27c3-4953-ac18-12fe3c9c3248"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8853b998-b2fe-4016-a2a3-c102c8a06c65"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8853b998-b2fe-4016-a2a3-c102c8a06c65"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#333846ad-a58c-4c23-8076-a62b2abf930d"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#8c8a70db-9cbd-4c35-b829-ff05f8e1f83c"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#23013092-4ff3-46c8-837e-8a85e8a2ef5e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#23013092-4ff3-46c8-837e-8a85e8a2ef5e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1b058dc9-b6b9-4ff9-a88e-a000f958a880"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#3f0f5b38-85ef-45df-9a52-c030dcbf7502"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#057e3949-6862-4ad3-a797-9b72134e4f0b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#057e3949-6862-4ad3-a797-9b72134e4f0b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#68aea6aa-ee2d-4882-91c6-ed2b708e6f31"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#7a47f150-0a49-496b-913b-f0e673fb373a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#2b02b850-0f21-4942-908e-9e88849d337f"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#2b02b850-0f21-4942-908e-9e88849d337f"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0512cd3a-da4e-4046-a32f-21f413c93bdc"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#173f2853-5eff-440e-9718-b743a4c7bc6f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#173f2853-5eff-440e-9718-b743a4c7bc6f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0014b90b-7176-43f6-8b2d-32dc81529710"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1d4c097d-034f-4081-b9b7-931613cc14d2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1d4c097d-034f-4081-b9b7-931613cc14d2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0d3e62e0-59a1-4f73-a0bd-295ceca7a468"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#701bbf52-9fc9-4054-b3e2-b3355713804a"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#701bbf52-9fc9-4054-b3e2-b3355713804a"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#2070e13a-d897-475a-9bbd-0e53f5739da9"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#150c30f0-6c58-4c51-b69b-9ece8365847a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#5346ff76-2aff-4d62-9675-a959f5b38a9a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#5346ff76-2aff-4d62-9675-a959f5b38a9a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#079096d0-45fb-4648-9ecf-2a2944f96aa4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#02647896-404e-46ef-b6c9-b366e935c90f"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#642b2d00-187e-4209-94fd-12eecaf9e384"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#642b2d00-187e-4209-94fd-12eecaf9e384"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#3450bc13-273c-47c7-a1c8-1039fc2dfc1c"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#36fdba8b-d76e-4ba6-8771-7dfcd2d825c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#36fdba8b-d76e-4ba6-8771-7dfcd2d825c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#23194280-25dc-4461-9cb4-37f085845a2a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#09f83b07-35d1-4211-a43a-df5c80ad3962"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#09f83b07-35d1-4211-a43a-df5c80ad3962"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#05610358-d517-4c49-974c-99e0db73b315"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#07789c81-94f8-4d8d-b484-57cbd3079c69"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#07789c81-94f8-4d8d-b484-57cbd3079c69"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0b4b4267-71eb-4599-9578-655c89eade93"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#19c5a50b-3df4-4b68-b3ff-05830b83c82d"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#19c5a50b-3df4-4b68-b3ff-05830b83c82d"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0a0b6166-f04f-43d1-9e3b-86a44c499ee5"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6c8a6e01-3d5c-4f9c-b1c7-04180b4274da"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6c8a6e01-3d5c-4f9c-b1c7-04180b4274da"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0b95acbc-3dbb-4cc0-9123-872b52f6bbf7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-42778",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 9.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        502
      ],
      "description": "The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:\n\n\n\n\nThe fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade\n\n\n\n\n\n\nThe fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.1.0 <= 2.1.110, and 2.2.0 <= 2.2.6.\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade",
      "recommendation": "Upgrade org.apache.mina:mina-core to version 2.1.12, 2.2.7",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42778"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42778"
        },
        {
          "url": "https://github.com/advisories/GHSA-76h9-2vwh-w278"
        },
        {
          "url": "https://github.com/advisories/GHSA-f2wh-grmh-r6jm"
        },
        {
          "url": "https://github.com/apache/mina"
        },
        {
          "url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
        }
      ],
      "published": "2026-05-01T11:16:19+00:00",
      "updated": "2026-05-01T17:55:49+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-42779",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 9.8,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        502
      ],
      "description": "The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:\n\n\n\n\n\n\n\n\n\n\n\nApache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.\n\n\n\n\nThe fix checks if the class is present in the accepted class filter before calling Class.forName(). \n\n\n\n\n\n\nAffected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.\n\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\n\nAffected are applications using Apache MINA that call  IoBuffer.getObject().\n\n\n\n\n\nApplications using Apache MINA are advised to upgrade.",
      "recommendation": "Upgrade org.apache.mina:mina-core to version 2.1.12, 2.2.7",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-42779"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-42779"
        },
        {
          "url": "https://github.com/advisories/GHSA-8297-v2rf-2p32"
        },
        {
          "url": "https://github.com/apache/mina"
        },
        {
          "url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
        }
      ],
      "published": "2026-05-01T11:16:19+00:00",
      "updated": "2026-05-01T17:55:28+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.apache.mina/mina-core@2.2.4",
          "versions": [
            {
              "version": "2.2.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2c500be2-9e00-4e0f-97cd-d7b49f837193"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:af30582b-3e1d-41f9-b509-8aef46dfbc62/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#64daf632-fa79-4cb1-8cb2-96f0513925a6"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:9189bab3-9cea-41e9-9ffa-8f2aac03e32c/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1f6fac11-b512-4d5a-bfc4-701549e7ef76"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#7c27ce5c-5c6d-44dc-91a1-0b0181c0ced7"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1fcc8e85-7fa2-47a1-a59a-9b2d279f71b8"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0e6b4d40-4a9d-4952-91d9-404fffa66485"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09ccf685-c327-4e32-bc35-256e8e1af5a0"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#826b3924-3302-4571-967c-9fd4136ee2d1"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#07399364-76bf-4a89-a7b6-e900fb3496aa"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.mina/mina-core@2.2.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#6d529220-3e70-4ca5-a425-67ea4936c2a5"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#3ffbd4c5-9d08-4bd8-b4bd-ad1b31c59847"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1001802e-8cbe-4fec-bb93-048963ebef90"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0ecd3bad-247e-480f-ae61-4433bd3dc359"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14e4df3f-e4bd-40df-be19-a1def8740924"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0e95002c-4005-40a5-b75f-10012f866163"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-44248",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        400
      ],
      "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
      "recommendation": "Upgrade io.netty:netty-codec-mqtt to version 4.2.13.Final, 4.1.133.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44248"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-44248"
        },
        {
          "url": "https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901027"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44248"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44248"
        }
      ],
      "published": "2026-05-13T19:17:27+00:00",
      "updated": "2026-05-18T12:15:48+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#12423bea-8a1a-4d09-9969-239b79135f39"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#12423bea-8a1a-4d09-9969-239b79135f39"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0372e35b-8180-4403-bf22-1ac0d5a57753"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0372e35b-8180-4403-bf22-1ac0d5a57753"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#1cbb38aa-6ac1-4e93-8572-afcbeff9d82e"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#1cbb38aa-6ac1-4e93-8572-afcbeff9d82e"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#b29a50c7-fc29-4cae-b40a-477b74002304"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#b29a50c7-fc29-4cae-b40a-477b74002304"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46ac7a8c-96db-4e98-9629-e01a6ab69527"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46ac7a8c-96db-4e98-9629-e01a6ab69527"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#285adc23-bb84-45ea-8b62-64fd62a37ec5"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#285adc23-bb84-45ea-8b62-64fd62a37ec5"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1e1b84ec-71d3-41c8-8492-aa65a8356030"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1e1b84ec-71d3-41c8-8492-aa65a8356030"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#3254c8d6-d4dc-44c0-97c6-1caa68bbff89"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#3254c8d6-d4dc-44c0-97c6-1caa68bbff89"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#4c82b2aa-76dd-4495-a163-8a0599e44909"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#4c82b2aa-76dd-4495-a163-8a0599e44909"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-mqtt@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#30600547-ce97-406e-88e6-a6ce72545d89"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#30600547-ce97-406e-88e6-a6ce72545d89"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#7d1cfc3c-dfd7-4c17-aa03-9f1a9b9e02c1"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#7d1cfc3c-dfd7-4c17-aa03-9f1a9b9e02c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#14edbfba-15b2-4758-bc49-f4fdaa478599"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#14edbfba-15b2-4758-bc49-f4fdaa478599"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1dc76177-7f2c-46ab-8621-f20ff22a2001"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1dc76177-7f2c-46ab-8621-f20ff22a2001"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0bc8b0f2-5fd3-4a40-9aa4-fa2e06375130"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0bc8b0f2-5fd3-4a40-9aa4-fa2e06375130"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#033e3dbd-8061-48f8-85c0-bd0262196b1c"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#033e3dbd-8061-48f8-85c0-bd0262196b1c"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#569ec1a6-5bb8-4d95-a3d0-7777affbf400"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#569ec1a6-5bb8-4d95-a3d0-7777affbf400"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-44249",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 8.1,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "description": "### Summary\nAn attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.\n\n### Details\n`io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress)` method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.\n\n### Impact\nAccess Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.",
      "recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44249"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.132.Final",
          "versions": [
            {
              "version": "4.1.132.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:fc5cf0fc-7821-4948-acb8-90606380af97/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-44250",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "description": "### Summary\nAn attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError.\n\n### Details\nio.netty.handler.codec.redis.RedisArrayAggregator aggregates RedisMessage parts into ArrayRedisMessage. It uses a `Deque<AggregateState>` to keep track of nested arrays. However, it does not limit the maximum depth of nested arrays. When an attacker sends a continuous stream of nested array headers (e.g., `*1\\r\\n*1\\r\\n*1\\r\\n...`), RedisArrayAggregator pushes a `new AggregateState` onto the stack and allocates a `new ArrayList` for each header. Because there is no depth limit, an attacker can send millions of such headers. This consumes a massive amount of heap memory for the AggregateState instances and their backing ArrayLists, eventually resulting in an OutOfMemoryError.\n\n### Impact\nDenial of Service due to memory exhaustion. Any application using Netty's RedisArrayAggregator to handle untrusted Redis traffic is vulnerable.",
      "recommendation": "Upgrade io.netty:netty-codec-redis to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44250"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-redis@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-redis@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0e28ed06-0913-4c64-a513-692392c9e39b"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0e28ed06-0913-4c64-a513-692392c9e39b"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#871937ab-c02c-4335-ab93-55e47a79fc2d"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#871937ab-c02c-4335-ab93-55e47a79fc2d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#246d4607-adad-41d4-a495-6fb7b90c1ac7"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#246d4607-adad-41d4-a495-6fb7b90c1ac7"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#6a5f6ef8-37ca-461a-bb38-392ac1f5d3e3"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#6a5f6ef8-37ca-461a-bb38-392ac1f5d3e3"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4e0bdb1f-c8e9-4af3-9115-322e304bffa3"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4e0bdb1f-c8e9-4af3-9115-322e304bffa3"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1939bb13-59d1-42b8-a124-f35332a47297"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1939bb13-59d1-42b8-a124-f35332a47297"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#5534c6ff-3a8f-4950-acf5-877804b24b33"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#5534c6ff-3a8f-4950-acf5-877804b24b33"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#2806b977-f338-4d64-8e9a-6bc332e80763"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#2806b977-f338-4d64-8e9a-6bc332e80763"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#60e9e636-6107-4ba5-93cc-08ffd9940b2c"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#60e9e636-6107-4ba5-93cc-08ffd9940b2c"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#53876b0a-0f92-443c-a9f4-5af8e927fb66"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#53876b0a-0f92-443c-a9f4-5af8e927fb66"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#de2a541b-327c-46b4-8eef-37e2a3475a18"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#de2a541b-327c-46b4-8eef-37e2a3475a18"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0e22540f-dfdd-4e68-a83e-83311ec28c08"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0e22540f-dfdd-4e68-a83e-83311ec28c08"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2e347b2c-8881-4159-b1ec-b6f4b4fd391d"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2e347b2c-8881-4159-b1ec-b6f4b4fd391d"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e311648-3aad-4dce-8473-92498412e23f"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e311648-3aad-4dce-8473-92498412e23f"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#143657b4-6c4b-49f3-b372-f91752cf27b4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#143657b4-6c4b-49f3-b372-f91752cf27b4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08fe99ae-ae31-4da3-9054-b9e1eca728b6"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08fe99ae-ae31-4da3-9054-b9e1eca728b6"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-44890",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "description": "### Summary\nAn attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\\r\\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed.\n\n### Details\nio.netty.handler.codec.redis.RedisDecoder decodes the length of bulk strings and array headers using the `decodeLength` method. This method reads bytes from the network until it encounters a `\\n` character. However, it does not enforce any maximum length check while buffering the bytes if the `\\n` character is not found. An attacker can exploit this by sending a continuous stream of digits (e.g., `$1111...`) without ever sending a `\\n`.\n\nTo cause a true Denial of Service, an attacker must open multiple concurrent connections and distribute the unbounded payloads among them.\n\nAccording to the RESP specification (https://redis.io/docs/latest/develop/reference/protocol-spec/), all parts of the protocol are strictly terminated with `\\r\\n`. Furthermore, the length prefix itself is an integer representation that must fit within standard numeric limits (e.g., a 64-bit signed integer). Therefore, a stream of digits exceeding these bounds without `\\r\\n` is a protocol violation and should be rejected immediately rather than buffered indefinitely.\n\n### Impact\nDenial of Service due to memory exhaustion. Any application using Netty's RedisDecoder to handle untrusted Redis traffic is vulnerable.",
      "recommendation": "Upgrade io.netty:netty-codec-redis to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44890"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-redis@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-redis@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0e28ed06-0913-4c64-a513-692392c9e39b"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0e28ed06-0913-4c64-a513-692392c9e39b"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#871937ab-c02c-4335-ab93-55e47a79fc2d"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#871937ab-c02c-4335-ab93-55e47a79fc2d"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#246d4607-adad-41d4-a495-6fb7b90c1ac7"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#246d4607-adad-41d4-a495-6fb7b90c1ac7"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#6a5f6ef8-37ca-461a-bb38-392ac1f5d3e3"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#6a5f6ef8-37ca-461a-bb38-392ac1f5d3e3"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4e0bdb1f-c8e9-4af3-9115-322e304bffa3"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#4e0bdb1f-c8e9-4af3-9115-322e304bffa3"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1939bb13-59d1-42b8-a124-f35332a47297"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1939bb13-59d1-42b8-a124-f35332a47297"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#5534c6ff-3a8f-4950-acf5-877804b24b33"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#5534c6ff-3a8f-4950-acf5-877804b24b33"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#2806b977-f338-4d64-8e9a-6bc332e80763"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#2806b977-f338-4d64-8e9a-6bc332e80763"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#60e9e636-6107-4ba5-93cc-08ffd9940b2c"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#60e9e636-6107-4ba5-93cc-08ffd9940b2c"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-redis@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#53876b0a-0f92-443c-a9f4-5af8e927fb66"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#53876b0a-0f92-443c-a9f4-5af8e927fb66"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#de2a541b-327c-46b4-8eef-37e2a3475a18"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#de2a541b-327c-46b4-8eef-37e2a3475a18"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0e22540f-dfdd-4e68-a83e-83311ec28c08"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#0e22540f-dfdd-4e68-a83e-83311ec28c08"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2e347b2c-8881-4159-b1ec-b6f4b4fd391d"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2e347b2c-8881-4159-b1ec-b6f4b4fd391d"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e311648-3aad-4dce-8473-92498412e23f"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e311648-3aad-4dce-8473-92498412e23f"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#143657b4-6c4b-49f3-b372-f91752cf27b4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#143657b4-6c4b-49f3-b372-f91752cf27b4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08fe99ae-ae31-4da3-9054-b9e1eca728b6"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#08fe99ae-ae31-4da3-9054-b9e1eca728b6"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-44893",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "description": "When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released.",
      "recommendation": "Upgrade io.netty:netty-codec-haproxy to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-44893"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#71cf56a7-7ffc-438a-9fb7-bd241f75985e"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#71cf56a7-7ffc-438a-9fb7-bd241f75985e"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4f7926dc-2a3d-4228-9e2a-7eedfb2b47f9"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4f7926dc-2a3d-4228-9e2a-7eedfb2b47f9"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#826fee47-0ac5-4acc-bfc7-e8031f21ff96"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#826fee47-0ac5-4acc-bfc7-e8031f21ff96"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#100ecc29-fa10-426e-a712-949d90bb8c75"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#100ecc29-fa10-426e-a712-949d90bb8c75"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#774d25ef-e8eb-4e47-ab48-5c04298a1ab5"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#774d25ef-e8eb-4e47-ab48-5c04298a1ab5"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#001f7a78-7462-4fee-890a-5bace8349aaf"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#001f7a78-7462-4fee-890a-5bace8349aaf"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#316644de-db52-4ec6-9e1d-0b3d124bd674"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#316644de-db52-4ec6-9e1d-0b3d124bd674"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09b4b753-2bfd-43e5-8eb7-275b6770a93f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#09b4b753-2bfd-43e5-8eb7-275b6770a93f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#6fbad1e6-7d65-402c-8ee7-8a16d03c9001"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#6fbad1e6-7d65-402c-8ee7-8a16d03c9001"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#1acf99f7-806c-42fa-a3b5-d8d5c66bf99b"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#1acf99f7-806c-42fa-a3b5-d8d5c66bf99b"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#37aad627-74f2-47f5-b9a5-434d88b8cbef"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#37aad627-74f2-47f5-b9a5-434d88b8cbef"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#1d94c323-fa2b-45e8-a746-84b475e4c9e7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#1d94c323-fa2b-45e8-a746-84b475e4c9e7"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4335e2e9-4ad1-43ef-ba3f-3563d18da78d"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4335e2e9-4ad1-43ef-ba3f-3563d18da78d"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#2043aada-7937-4023-82be-6f76bc180824"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#2043aada-7937-4023-82be-6f76bc180824"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0e470fcb-fab9-4d17-9d96-3e71f43e7a63"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0e470fcb-fab9-4d17-9d96-3e71f43e7a63"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#32ca4e5b-69c9-4af2-aab2-e61023a9bddf"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#32ca4e5b-69c9-4af2-aab2-e61023a9bddf"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-45292",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        770
      ],
      "description": "opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.",
      "recommendation": "Upgrade io.opentelemetry:opentelemetry-api to version 1.62.0",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45292"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-45292"
        },
        {
          "url": "https://github.com/open-telemetry/opentelemetry-java"
        },
        {
          "url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"
        },
        {
          "url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380"
        },
        {
          "url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0"
        },
        {
          "url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45292"
        }
      ],
      "published": "2026-05-28T17:16:32+00:00",
      "updated": "2026-05-29T15:42:56+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0",
          "versions": [
            {
              "version": "1.47.0",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#18541cc7-9cfc-44ad-b895-c0d36de0c4a9"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#054d1bce-4698-46c1-bab9-5475a300e16b"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#18b89bc2-75c0-4fdf-8859-4fbe4fd964fe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.47.0"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#32c59e3f-747b-43dc-a694-6de28530369e"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#414ac5dd-6299-4563-8c6d-0eca6c4286de"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2c5cc9cd-fde0-4eae-954e-52299c866bed"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#33fb98ce-1ae5-4c64-9bc9-5f647594d2ae"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#29d2b09c-5f49-4b0e-8ee9-3b3c08b62ad7"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0e359562-29fa-419f-8e4a-09dd5896bfae"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#2c1eae77-70f1-44a0-aecb-5cd432377322"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-45300",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.4,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
        }
      ],
      "cwes": [
        200
      ],
      "description": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.",
      "recommendation": "Upgrade org.asynchttpclient:async-http-client to version 3.0.10, 2.15.0",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45300"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10"
        },
        {
          "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45300"
        }
      ],
      "published": "2026-06-05T20:17:31+00:00",
      "updated": "2026-06-08T18:37:41+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.4",
          "versions": [
            {
              "version": "2.12.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.4",
          "versions": [
            {
              "version": "2.12.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.4",
          "versions": [
            {
              "version": "2.12.4",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#7a2400b7-7c0f-4228-bcb3-3a8f7023e572"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#7a2400b7-7c0f-4228-bcb3-3a8f7023e572"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#7a2400b7-7c0f-4228-bcb3-3a8f7023e572"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0674a596-912a-4ca2-b3ba-d8a4fb8a673a"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0674a596-912a-4ca2-b3ba-d8a4fb8a673a"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#0674a596-912a-4ca2-b3ba-d8a4fb8a673a"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4ee304db-a22e-4e61-bbea-2a3cd7012761"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4ee304db-a22e-4e61-bbea-2a3cd7012761"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4ee304db-a22e-4e61-bbea-2a3cd7012761"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7bf210cf-ecce-4fa8-830d-4fcb9e996e0f"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7bf210cf-ecce-4fa8-830d-4fcb9e996e0f"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#7bf210cf-ecce-4fa8-830d-4fcb9e996e0f"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46a4e722-4119-4a17-82d9-9326fac8ee5b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46a4e722-4119-4a17-82d9-9326fac8ee5b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#46a4e722-4119-4a17-82d9-9326fac8ee5b"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#06221ded-8c14-488f-8277-4512ca5a8c98"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#06221ded-8c14-488f-8277-4512ca5a8c98"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#06221ded-8c14-488f-8277-4512ca5a8c98"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1f159064-fabc-4b52-b52c-8577659eac93"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1f159064-fabc-4b52-b52c-8577659eac93"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#1f159064-fabc-4b52-b52c-8577659eac93"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1fea405d-404f-42c2-9885-fb95b3d34b07"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1fea405d-404f-42c2-9885-fb95b3d34b07"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1fea405d-404f-42c2-9885-fb95b3d34b07"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#69f7dd1f-5207-4bbb-8b26-b6c6bf1b5974"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#69f7dd1f-5207-4bbb-8b26-b6c6bf1b5974"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#69f7dd1f-5207-4bbb-8b26-b6c6bf1b5974"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#06d39c74-bdfe-44d0-a1cd-9a8ae90bd9d4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#06d39c74-bdfe-44d0-a1cd-9a8ae90bd9d4"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#06d39c74-bdfe-44d0-a1cd-9a8ae90bd9d4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.asynchttpclient/async-http-client@2.12.4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#51eab3bf-fb80-40cb-ab06-568e421fc979"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#51eab3bf-fb80-40cb-ab06-568e421fc979"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#51eab3bf-fb80-40cb-ab06-568e421fc979"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#08c8ff80-bbeb-4f94-a27e-6cc45337d92b"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#08c8ff80-bbeb-4f94-a27e-6cc45337d92b"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#08c8ff80-bbeb-4f94-a27e-6cc45337d92b"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2cf4cc34-0874-42ef-8ca9-5095cd2aff23"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2cf4cc34-0874-42ef-8ca9-5095cd2aff23"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#2cf4cc34-0874-42ef-8ca9-5095cd2aff23"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0067a2d8-71f7-48ab-9319-4d0ad699206c"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0067a2d8-71f7-48ab-9319-4d0ad699206c"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0067a2d8-71f7-48ab-9319-4d0ad699206c"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#45e73d3f-0465-428a-b43b-2b246081bd76"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#45e73d3f-0465-428a-b43b-2b246081bd76"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#45e73d3f-0465-428a-b43b-2b246081bd76"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#67db38c1-a195-45c1-9935-d7ffcfdb214f"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#67db38c1-a195-45c1-9935-d7ffcfdb214f"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#67db38c1-a195-45c1-9935-d7ffcfdb214f"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-45416",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "description": "SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes.",
      "recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45416"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-handler@4.1.132.Final",
          "versions": [
            {
              "version": "4.1.132.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#17787358-ed94-4e4d-adbf-18cc549bc83d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#312f885d-4ecc-491c-91e9-4c442907b0bc"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#6ba50519-52d6-4bc6-8fd6-3eae19870af4"
        },
        {
          "ref": "urn:cdx:fc5cf0fc-7821-4948-acb8-90606380af97/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#08a118d5-f3fa-4052-8084-25c310c679d3"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#1a53dcd7-7a36-4885-9d32-4de1e3cc8ef9"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0bf6a6e0-1885-4b1e-ad62-f1f68b86a4a1"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#723ab430-9506-4f2d-a8ff-d3a1bc9815e7"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#06a41ed3-7de9-4ccb-b76c-f6393f8b354e"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#1d1ffc84-f851-490d-a618-b2c92e14426d"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0e1fa855-43ea-4e69-b2f0-79f9eca16007"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0661a167-6738-4421-b4f5-2299a0ae14b9"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0a18aafb-55fe-43bc-aba6-7d8fd430fdfe"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#3cc66c85-49c0-47a2-a2cf-bfe4ba298811"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#17db6f97-8c61-4bec-85bd-578b7a02d4fc"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#34b02d4e-bdf5-499a-8ccf-54d5efe8316f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#72cfaf86-1130-4861-adac-2239847256c3"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4ff897ca-b967-4d1e-998e-0d1c73c5a811"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#00b4c406-7778-4d3a-8f79-82e8b879a239"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4d868f33-0dd0-482e-858c-86973b3d5877"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1bd1cc76-7040-49ce-a0c1-6650c82f87af"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#129438f3-c38a-4ca5-ace8-ed3cfa5ce5e6"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/io.netty/netty-handler@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#185cf998-c655-4acf-ae98-fbe48baf0449"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-45536",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "description": "netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) \u2014 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking \u2192 EAGAIN \u2192 Java maps to 0 \u2192 read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default).",
      "recommendation": "Upgrade io.netty:netty-transport-native-epoll to version 4.2.15.Final, 4.1.135.Final; Upgrade io.netty:netty-transport-native-kqueue to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45536"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final",
          "versions": [
            {
              "version": "4.1.132.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#45b6c222-4453-4cc5-a97f-3a0acf66af81"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0a52e0bb-9323-4f02-86bf-b5613cdac1b6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0a52e0bb-9323-4f02-86bf-b5613cdac1b6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#45b6c222-4453-4cc5-a97f-3a0acf66af81"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#45b6c222-4453-4cc5-a97f-3a0acf66af81"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0a52e0bb-9323-4f02-86bf-b5613cdac1b6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0a52e0bb-9323-4f02-86bf-b5613cdac1b6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#45b6c222-4453-4cc5-a97f-3a0acf66af81"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#45b6c222-4453-4cc5-a97f-3a0acf66af81"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#45b6c222-4453-4cc5-a97f-3a0acf66af81"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0a52e0bb-9323-4f02-86bf-b5613cdac1b6"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#0a52e0bb-9323-4f02-86bf-b5613cdac1b6"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#7a7492ab-9b75-4c54-afcd-3abdc9cce31d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#4b9fc450-91dd-4eac-9a26-6f24c3f1949d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#4b9fc450-91dd-4eac-9a26-6f24c3f1949d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#7a7492ab-9b75-4c54-afcd-3abdc9cce31d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#7a7492ab-9b75-4c54-afcd-3abdc9cce31d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#4b9fc450-91dd-4eac-9a26-6f24c3f1949d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#4b9fc450-91dd-4eac-9a26-6f24c3f1949d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#7a7492ab-9b75-4c54-afcd-3abdc9cce31d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#7a7492ab-9b75-4c54-afcd-3abdc9cce31d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#7a7492ab-9b75-4c54-afcd-3abdc9cce31d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#4b9fc450-91dd-4eac-9a26-6f24c3f1949d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#4b9fc450-91dd-4eac-9a26-6f24c3f1949d"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4db4024d-6451-4e70-9588-071d073e3e95"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#01caad67-138b-41b6-8b28-068e585d27dd"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#01caad67-138b-41b6-8b28-068e585d27dd"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4db4024d-6451-4e70-9588-071d073e3e95"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4db4024d-6451-4e70-9588-071d073e3e95"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#01caad67-138b-41b6-8b28-068e585d27dd"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#01caad67-138b-41b6-8b28-068e585d27dd"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4db4024d-6451-4e70-9588-071d073e3e95"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4db4024d-6451-4e70-9588-071d073e3e95"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#4db4024d-6451-4e70-9588-071d073e3e95"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#01caad67-138b-41b6-8b28-068e585d27dd"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#01caad67-138b-41b6-8b28-068e585d27dd"
        },
        {
          "ref": "urn:cdx:fc5cf0fc-7821-4948-acb8-90606380af97/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3166430d-05e7-4a8d-9892-96970c3b4280"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6e652f3c-7c8b-4cbc-842b-73ffa33af006"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6e652f3c-7c8b-4cbc-842b-73ffa33af006"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3166430d-05e7-4a8d-9892-96970c3b4280"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3166430d-05e7-4a8d-9892-96970c3b4280"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6e652f3c-7c8b-4cbc-842b-73ffa33af006"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6e652f3c-7c8b-4cbc-842b-73ffa33af006"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3166430d-05e7-4a8d-9892-96970c3b4280"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3166430d-05e7-4a8d-9892-96970c3b4280"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#3166430d-05e7-4a8d-9892-96970c3b4280"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6e652f3c-7c8b-4cbc-842b-73ffa33af006"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#6e652f3c-7c8b-4cbc-842b-73ffa33af006"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#9ac12920-405f-4c3a-81b4-3d5ef50128f4"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#21e08c2c-de81-4c11-94f5-2afa2dc927ea"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#21e08c2c-de81-4c11-94f5-2afa2dc927ea"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#9ac12920-405f-4c3a-81b4-3d5ef50128f4"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#9ac12920-405f-4c3a-81b4-3d5ef50128f4"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#21e08c2c-de81-4c11-94f5-2afa2dc927ea"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#21e08c2c-de81-4c11-94f5-2afa2dc927ea"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#9ac12920-405f-4c3a-81b4-3d5ef50128f4"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#9ac12920-405f-4c3a-81b4-3d5ef50128f4"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#9ac12920-405f-4c3a-81b4-3d5ef50128f4"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#21e08c2c-de81-4c11-94f5-2afa2dc927ea"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#21e08c2c-de81-4c11-94f5-2afa2dc927ea"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#9d52cafb-1d7d-418a-ba11-ae6bffb219e7"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#9d52cafb-1d7d-418a-ba11-ae6bffb219e7"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#9d52cafb-1d7d-418a-ba11-ae6bffb219e7"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#9d52cafb-1d7d-418a-ba11-ae6bffb219e7"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#9d52cafb-1d7d-418a-ba11-ae6bffb219e7"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#9d52cafb-1d7d-418a-ba11-ae6bffb219e7"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#1d5cef4a-165a-400a-813b-ecc5cedafdd7"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#1d5cef4a-165a-400a-813b-ecc5cedafdd7"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#1d5cef4a-165a-400a-813b-ecc5cedafdd7"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#1d5cef4a-165a-400a-813b-ecc5cedafdd7"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#1d5cef4a-165a-400a-813b-ecc5cedafdd7"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#1d5cef4a-165a-400a-813b-ecc5cedafdd7"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#3dbf6a28-3167-4f69-87db-f89704f2dae0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#6cf68312-0f9d-4f92-b1b4-4c53fcc9bdd9"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#6cf68312-0f9d-4f92-b1b4-4c53fcc9bdd9"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#3dbf6a28-3167-4f69-87db-f89704f2dae0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#3dbf6a28-3167-4f69-87db-f89704f2dae0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#6cf68312-0f9d-4f92-b1b4-4c53fcc9bdd9"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#6cf68312-0f9d-4f92-b1b4-4c53fcc9bdd9"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#3dbf6a28-3167-4f69-87db-f89704f2dae0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#3dbf6a28-3167-4f69-87db-f89704f2dae0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#3dbf6a28-3167-4f69-87db-f89704f2dae0"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#6cf68312-0f9d-4f92-b1b4-4c53fcc9bdd9"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#6cf68312-0f9d-4f92-b1b4-4c53fcc9bdd9"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#2f17d2f5-035a-4ccf-ac37-73b5fc0e402e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#03ea6763-6cc4-4ead-a0f9-3f1a12a876b4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#03ea6763-6cc4-4ead-a0f9-3f1a12a876b4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#2f17d2f5-035a-4ccf-ac37-73b5fc0e402e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#2f17d2f5-035a-4ccf-ac37-73b5fc0e402e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#03ea6763-6cc4-4ead-a0f9-3f1a12a876b4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#03ea6763-6cc4-4ead-a0f9-3f1a12a876b4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#2f17d2f5-035a-4ccf-ac37-73b5fc0e402e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#2f17d2f5-035a-4ccf-ac37-73b5fc0e402e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#2f17d2f5-035a-4ccf-ac37-73b5fc0e402e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#03ea6763-6cc4-4ead-a0f9-3f1a12a876b4"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#03ea6763-6cc4-4ead-a0f9-3f1a12a876b4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#85b01c9e-5609-43b5-8c38-02d3d7aaf18d"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#0d7687fa-e54d-42e7-a3db-276efc9c0afb"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#0d7687fa-e54d-42e7-a3db-276efc9c0afb"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#85b01c9e-5609-43b5-8c38-02d3d7aaf18d"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#85b01c9e-5609-43b5-8c38-02d3d7aaf18d"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#0d7687fa-e54d-42e7-a3db-276efc9c0afb"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#0d7687fa-e54d-42e7-a3db-276efc9c0afb"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#85b01c9e-5609-43b5-8c38-02d3d7aaf18d"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#85b01c9e-5609-43b5-8c38-02d3d7aaf18d"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#85b01c9e-5609-43b5-8c38-02d3d7aaf18d"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#0d7687fa-e54d-42e7-a3db-276efc9c0afb"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#0d7687fa-e54d-42e7-a3db-276efc9c0afb"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:37b42d04-b5a3-4dfe-9eaf-be1ff86d3f33/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#110b18c6-db29-4be5-8c88-4335fd82fd6b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18d3ec31-892f-4478-ae5d-961cd278cc30"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18d3ec31-892f-4478-ae5d-961cd278cc30"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#110b18c6-db29-4be5-8c88-4335fd82fd6b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#110b18c6-db29-4be5-8c88-4335fd82fd6b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18d3ec31-892f-4478-ae5d-961cd278cc30"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18d3ec31-892f-4478-ae5d-961cd278cc30"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#110b18c6-db29-4be5-8c88-4335fd82fd6b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#110b18c6-db29-4be5-8c88-4335fd82fd6b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#110b18c6-db29-4be5-8c88-4335fd82fd6b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18d3ec31-892f-4478-ae5d-961cd278cc30"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18d3ec31-892f-4478-ae5d-961cd278cc30"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#61c619ab-e617-4bcc-8bdd-09292cb7818c"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#048c7d51-0f25-4c27-9f26-0bacf4cff7e4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#048c7d51-0f25-4c27-9f26-0bacf4cff7e4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#61c619ab-e617-4bcc-8bdd-09292cb7818c"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#61c619ab-e617-4bcc-8bdd-09292cb7818c"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#048c7d51-0f25-4c27-9f26-0bacf4cff7e4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#048c7d51-0f25-4c27-9f26-0bacf4cff7e4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#61c619ab-e617-4bcc-8bdd-09292cb7818c"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#61c619ab-e617-4bcc-8bdd-09292cb7818c"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#61c619ab-e617-4bcc-8bdd-09292cb7818c"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#048c7d51-0f25-4c27-9f26-0bacf4cff7e4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#048c7d51-0f25-4c27-9f26-0bacf4cff7e4"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#09386911-a2de-48bd-816d-1743e8cf6695"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1aca2f6d-20ae-44ab-8b9d-e81b16b2661a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1aca2f6d-20ae-44ab-8b9d-e81b16b2661a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#09386911-a2de-48bd-816d-1743e8cf6695"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#09386911-a2de-48bd-816d-1743e8cf6695"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1aca2f6d-20ae-44ab-8b9d-e81b16b2661a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1aca2f6d-20ae-44ab-8b9d-e81b16b2661a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#09386911-a2de-48bd-816d-1743e8cf6695"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#09386911-a2de-48bd-816d-1743e8cf6695"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#09386911-a2de-48bd-816d-1743e8cf6695"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1aca2f6d-20ae-44ab-8b9d-e81b16b2661a"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#1aca2f6d-20ae-44ab-8b9d-e81b16b2661a"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0a0451fd-dc3d-4bf5-9717-21fd749d8938"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#026d83b6-ddb4-4c51-a238-184e25236817"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#026d83b6-ddb4-4c51-a238-184e25236817"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0a0451fd-dc3d-4bf5-9717-21fd749d8938"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0a0451fd-dc3d-4bf5-9717-21fd749d8938"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#026d83b6-ddb4-4c51-a238-184e25236817"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#026d83b6-ddb4-4c51-a238-184e25236817"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0a0451fd-dc3d-4bf5-9717-21fd749d8938"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0a0451fd-dc3d-4bf5-9717-21fd749d8938"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0a0451fd-dc3d-4bf5-9717-21fd749d8938"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#026d83b6-ddb4-4c51-a238-184e25236817"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#026d83b6-ddb4-4c51-a238-184e25236817"
        },
        {
          "ref": "urn:cdx:5b17e625-8ab4-442c-bd01-c0017d3e1d34/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0546986e-6a6f-4a7f-9c8a-7e90a59fdc79"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#541a404e-3eb7-4a19-9082-c3c79f2f27f0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#541a404e-3eb7-4a19-9082-c3c79f2f27f0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0546986e-6a6f-4a7f-9c8a-7e90a59fdc79"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0546986e-6a6f-4a7f-9c8a-7e90a59fdc79"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#541a404e-3eb7-4a19-9082-c3c79f2f27f0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#541a404e-3eb7-4a19-9082-c3c79f2f27f0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0546986e-6a6f-4a7f-9c8a-7e90a59fdc79"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0546986e-6a6f-4a7f-9c8a-7e90a59fdc79"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#0546986e-6a6f-4a7f-9c8a-7e90a59fdc79"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#541a404e-3eb7-4a19-9082-c3c79f2f27f0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#541a404e-3eb7-4a19-9082-c3c79f2f27f0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#0c93d0a2-e9d4-40cf-9717-a9353b726de4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#097c037d-bdc0-48bf-817b-6b6d08dc4b8f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#097c037d-bdc0-48bf-817b-6b6d08dc4b8f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#0c93d0a2-e9d4-40cf-9717-a9353b726de4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#0c93d0a2-e9d4-40cf-9717-a9353b726de4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#097c037d-bdc0-48bf-817b-6b6d08dc4b8f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#097c037d-bdc0-48bf-817b-6b6d08dc4b8f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#0c93d0a2-e9d4-40cf-9717-a9353b726de4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#0c93d0a2-e9d4-40cf-9717-a9353b726de4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#0c93d0a2-e9d4-40cf-9717-a9353b726de4"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#097c037d-bdc0-48bf-817b-6b6d08dc4b8f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#097c037d-bdc0-48bf-817b-6b6d08dc4b8f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#0997db40-98b0-473d-a645-fc182d3f6f90"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#5544d715-c417-45a0-a23f-c5f2b778bd79"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#5544d715-c417-45a0-a23f-c5f2b778bd79"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#0997db40-98b0-473d-a645-fc182d3f6f90"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#0997db40-98b0-473d-a645-fc182d3f6f90"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#5544d715-c417-45a0-a23f-c5f2b778bd79"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#5544d715-c417-45a0-a23f-c5f2b778bd79"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#0997db40-98b0-473d-a645-fc182d3f6f90"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#0997db40-98b0-473d-a645-fc182d3f6f90"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#0997db40-98b0-473d-a645-fc182d3f6f90"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#5544d715-c417-45a0-a23f-c5f2b778bd79"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#5544d715-c417-45a0-a23f-c5f2b778bd79"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10a3c6f9-7ce5-4035-a9df-7804668fe0db"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#16339986-0f5e-42f9-86e3-2af4810caf1a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#16339986-0f5e-42f9-86e3-2af4810caf1a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10a3c6f9-7ce5-4035-a9df-7804668fe0db"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10a3c6f9-7ce5-4035-a9df-7804668fe0db"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#16339986-0f5e-42f9-86e3-2af4810caf1a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#16339986-0f5e-42f9-86e3-2af4810caf1a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10a3c6f9-7ce5-4035-a9df-7804668fe0db"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10a3c6f9-7ce5-4035-a9df-7804668fe0db"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#10a3c6f9-7ce5-4035-a9df-7804668fe0db"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#16339986-0f5e-42f9-86e3-2af4810caf1a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#16339986-0f5e-42f9-86e3-2af4810caf1a"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#635cf967-b763-459a-857e-6fd972cac11c"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#635cf967-b763-459a-857e-6fd972cac11c"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#635cf967-b763-459a-857e-6fd972cac11c"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#635cf967-b763-459a-857e-6fd972cac11c"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#635cf967-b763-459a-857e-6fd972cac11c"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#635cf967-b763-459a-857e-6fd972cac11c"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#21fe7ed0-c3f0-4308-a86b-5ef7d60ecbc4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#0c451110-75ca-4e7b-b048-481b29369838"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#0c451110-75ca-4e7b-b048-481b29369838"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#21fe7ed0-c3f0-4308-a86b-5ef7d60ecbc4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#21fe7ed0-c3f0-4308-a86b-5ef7d60ecbc4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#0c451110-75ca-4e7b-b048-481b29369838"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#0c451110-75ca-4e7b-b048-481b29369838"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#21fe7ed0-c3f0-4308-a86b-5ef7d60ecbc4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#21fe7ed0-c3f0-4308-a86b-5ef7d60ecbc4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#21fe7ed0-c3f0-4308-a86b-5ef7d60ecbc4"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#0c451110-75ca-4e7b-b048-481b29369838"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#0c451110-75ca-4e7b-b048-481b29369838"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#21f45ae6-22e6-4435-bcb4-cabaf28728eb"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#09bf2590-c5b8-492e-9e02-aa104a42a3b7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#09bf2590-c5b8-492e-9e02-aa104a42a3b7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#21f45ae6-22e6-4435-bcb4-cabaf28728eb"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#21f45ae6-22e6-4435-bcb4-cabaf28728eb"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#09bf2590-c5b8-492e-9e02-aa104a42a3b7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#09bf2590-c5b8-492e-9e02-aa104a42a3b7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#21f45ae6-22e6-4435-bcb4-cabaf28728eb"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#21f45ae6-22e6-4435-bcb4-cabaf28728eb"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#21f45ae6-22e6-4435-bcb4-cabaf28728eb"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#09bf2590-c5b8-492e-9e02-aa104a42a3b7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#09bf2590-c5b8-492e-9e02-aa104a42a3b7"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1030e878-0776-4c6e-9c54-6601b519bb19"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#17bbc12c-6f86-4449-8d01-9a521ae9841f"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#17bbc12c-6f86-4449-8d01-9a521ae9841f"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1030e878-0776-4c6e-9c54-6601b519bb19"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1030e878-0776-4c6e-9c54-6601b519bb19"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#17bbc12c-6f86-4449-8d01-9a521ae9841f"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#17bbc12c-6f86-4449-8d01-9a521ae9841f"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1030e878-0776-4c6e-9c54-6601b519bb19"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1030e878-0776-4c6e-9c54-6601b519bb19"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#1030e878-0776-4c6e-9c54-6601b519bb19"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#17bbc12c-6f86-4449-8d01-9a521ae9841f"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#17bbc12c-6f86-4449-8d01-9a521ae9841f"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e55093d-6050-45db-928c-34bcc20fda7e"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0838eb55-d612-4176-8096-ac3c3a2e5982"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0838eb55-d612-4176-8096-ac3c3a2e5982"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e55093d-6050-45db-928c-34bcc20fda7e"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e55093d-6050-45db-928c-34bcc20fda7e"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0838eb55-d612-4176-8096-ac3c3a2e5982"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0838eb55-d612-4176-8096-ac3c3a2e5982"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e55093d-6050-45db-928c-34bcc20fda7e"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e55093d-6050-45db-928c-34bcc20fda7e"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#1e55093d-6050-45db-928c-34bcc20fda7e"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0838eb55-d612-4176-8096-ac3c3a2e5982"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#0838eb55-d612-4176-8096-ac3c3a2e5982"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0132f6c4-7bb3-41e6-8b89-b29b289a82fb"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0baaa718-e382-4d14-a21f-995aa4a9179b"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0baaa718-e382-4d14-a21f-995aa4a9179b"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0132f6c4-7bb3-41e6-8b89-b29b289a82fb"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0132f6c4-7bb3-41e6-8b89-b29b289a82fb"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0baaa718-e382-4d14-a21f-995aa4a9179b"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0baaa718-e382-4d14-a21f-995aa4a9179b"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0132f6c4-7bb3-41e6-8b89-b29b289a82fb"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0132f6c4-7bb3-41e6-8b89-b29b289a82fb"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0132f6c4-7bb3-41e6-8b89-b29b289a82fb"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0baaa718-e382-4d14-a21f-995aa4a9179b"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0baaa718-e382-4d14-a21f-995aa4a9179b"
        },
        {
          "ref": "urn:cdx:a9e16cda-baa0-4991-ab18-a3e7a7652d7f/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0d84f74e-37e5-4597-b3f2-551ca73a5978"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#06c0cbc6-0422-4279-9c8b-83a6e2e94b53"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#06c0cbc6-0422-4279-9c8b-83a6e2e94b53"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0d84f74e-37e5-4597-b3f2-551ca73a5978"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0d84f74e-37e5-4597-b3f2-551ca73a5978"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#06c0cbc6-0422-4279-9c8b-83a6e2e94b53"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#06c0cbc6-0422-4279-9c8b-83a6e2e94b53"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0d84f74e-37e5-4597-b3f2-551ca73a5978"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0d84f74e-37e5-4597-b3f2-551ca73a5978"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#0d84f74e-37e5-4597-b3f2-551ca73a5978"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#06c0cbc6-0422-4279-9c8b-83a6e2e94b53"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#06c0cbc6-0422-4279-9c8b-83a6e2e94b53"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-45673",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 6.8,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
        }
      ],
      "description": "### Summary\nNetty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack).\n\n### Details\nTwo factors contribute to this vulnerability in io.netty.resolver.dns:\n- Predictable Query IDs: `DnsQueryIdSpace` manages 16-bit transaction IDs in buckets of 16,384 IDs. It initializes only the first bucket. When an ID is returned, it is pushed back into the bucket at a random index generated by java.util.concurrent.ThreadLocalRandom:\n\n```java\nRandom random = ThreadLocalRandom.current();\nint insertionPosition = random.nextInt(count + 1);\n```\n\nBecause ThreadLocalRandom is a predictable LCG and the resolver operates within a single bucket, the sequence of IDs is predictable once the PRNG state is mathematically recovered.\n\n- Default Static Source Port: `DnsNameResolverBuilder` defaults to a `channelStrategy` of `ChannelPerResolver`. This binds the DatagramChannel once, resulting in a static source port for all subsequent queries.\n\nCombined, a static source port and predictable transaction IDs reduces the entropy required to secure DNS resolution against spoofing.\n\n### Impact\nDNS Cache Poisoning. Downstream applications using the default Netty DNS resolver may connect to malicious IPs, leading to traffic interception or MitM attacks.",
      "recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45673"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2456cb17-4ffd-4039-a938-17f4c90f19b2"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2456cb17-4ffd-4039-a938-17f4c90f19b2"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5c951a33-2994-4605-9856-03784aa39de5"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5c951a33-2994-4605-9856-03784aa39de5"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#ba451751-ac80-4830-bd27-96274ecffacc"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#ba451751-ac80-4830-bd27-96274ecffacc"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1d16622e-16e3-4cc7-90d9-3f5fec38fa65"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1d16622e-16e3-4cc7-90d9-3f5fec38fa65"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#9095d426-d154-4b5a-a224-a5e060a1b862"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#9095d426-d154-4b5a-a224-a5e060a1b862"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#32b4ba41-cf70-412b-a895-664eb06ac5e2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#32b4ba41-cf70-412b-a895-664eb06ac5e2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#66b96533-1fea-4046-b266-6333efc96135"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#66b96533-1fea-4046-b266-6333efc96135"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#b5ec9ef5-8d76-4872-8533-2f919eaa4d6f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#b5ec9ef5-8d76-4872-8533-2f919eaa4d6f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#1d529033-cf74-4dc5-b920-28540402a6c5"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#1d529033-cf74-4dc5-b920-28540402a6c5"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#12a684ce-506e-48c1-8e1b-26cf87898057"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#12a684ce-506e-48c1-8e1b-26cf87898057"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4fb793df-af1e-4e33-a682-cea7dd5f777e"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4fb793df-af1e-4e33-a682-cea7dd5f777e"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#5085e54a-46aa-4d19-9d32-75f8f3e319a7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#5085e54a-46aa-4d19-9d32-75f8f3e319a7"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3cb7de17-f368-4392-af56-a1e490970b7a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3cb7de17-f368-4392-af56-a1e490970b7a"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#19ae58c0-5fb5-4c9a-a46e-2e12749801c9"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#19ae58c0-5fb5-4c9a-a46e-2e12749801c9"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14f561ef-b5b8-4949-95a3-dd06fe8df6a7"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14f561ef-b5b8-4949-95a3-dd06fe8df6a7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#5268c472-d1bd-4a13-b0a9-89cfcfbe291b"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#5268c472-d1bd-4a13-b0a9-89cfcfbe291b"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-45674",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 8.7,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
        }
      ],
      "description": "### Summary\nNetty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.\n\n### Details\nIn `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.\n\nAccording to https://datatracker.ietf.org/doc/html/rfc5452#section-6 \n\n```\nCare must be taken to only accept\n   data if it is known that the originator is authoritative for the\n   QNAME or a parent of the QNAME.\n   One very simple way to achieve this is to only accept data if it is\n   part of the domain for which the query was intended.\n```\n\n### Impact\nDNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.",
      "recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45674"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2456cb17-4ffd-4039-a938-17f4c90f19b2"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2456cb17-4ffd-4039-a938-17f4c90f19b2"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5c951a33-2994-4605-9856-03784aa39de5"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5c951a33-2994-4605-9856-03784aa39de5"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#ba451751-ac80-4830-bd27-96274ecffacc"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#ba451751-ac80-4830-bd27-96274ecffacc"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1d16622e-16e3-4cc7-90d9-3f5fec38fa65"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1d16622e-16e3-4cc7-90d9-3f5fec38fa65"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#9095d426-d154-4b5a-a224-a5e060a1b862"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#9095d426-d154-4b5a-a224-a5e060a1b862"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#32b4ba41-cf70-412b-a895-664eb06ac5e2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#32b4ba41-cf70-412b-a895-664eb06ac5e2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#66b96533-1fea-4046-b266-6333efc96135"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#66b96533-1fea-4046-b266-6333efc96135"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#b5ec9ef5-8d76-4872-8533-2f919eaa4d6f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#b5ec9ef5-8d76-4872-8533-2f919eaa4d6f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#1d529033-cf74-4dc5-b920-28540402a6c5"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#1d529033-cf74-4dc5-b920-28540402a6c5"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#12a684ce-506e-48c1-8e1b-26cf87898057"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#12a684ce-506e-48c1-8e1b-26cf87898057"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4fb793df-af1e-4e33-a682-cea7dd5f777e"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4fb793df-af1e-4e33-a682-cea7dd5f777e"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#5085e54a-46aa-4d19-9d32-75f8f3e319a7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#5085e54a-46aa-4d19-9d32-75f8f3e319a7"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3cb7de17-f368-4392-af56-a1e490970b7a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3cb7de17-f368-4392-af56-a1e490970b7a"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#19ae58c0-5fb5-4c9a-a46e-2e12749801c9"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#19ae58c0-5fb5-4c9a-a46e-2e12749801c9"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14f561ef-b5b8-4949-95a3-dd06fe8df6a7"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14f561ef-b5b8-4949-95a3-dd06fe8df6a7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#5268c472-d1bd-4a13-b0a9-89cfcfbe291b"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#5268c472-d1bd-4a13-b0a9-89cfcfbe291b"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-45799",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "description": "# CVE-2026-45799\n\n## Maintainer summary\n\nWire's protobuf group-skipping logic did not reject negative lengths before skipping a\nlength-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an\nunchecked runtime exception during decoding instead of the documented `IOException` /\n`ProtocolException` failure path.\n\nThis can crash services that decode untrusted protobuf payloads and only handle Wire's documented\nchecked decoding failures.\n\n## Affected artifacts\n\n### `com.squareup.wire:wire-runtime`\n\nAffected versions: vulnerable releases before `6.3.0`.\n\nPatched versions: `6.3.0` and later.\n\nUsers should upgrade to `com.squareup.wire:wire-runtime:6.3.0` or later.\n\n### `com.squareup.wire:wire-runtime-jvm`\n\nAffected versions: vulnerable legacy releases, including `5.3.1` and `5.3.3`.\n\nPatched versions: none.\n\n`com.squareup.wire:wire-runtime-jvm` is a discontinued legacy artifact and will not receive a\npatched release. Users should migrate to `com.squareup.wire:wire-runtime:6.3.0` or later.\n\n### Wire 7 alpha releases\n\nThe fix has been merged to `master` and will be included in the next Wire 7 alpha release. Until\nthat release is available, Wire 7 alpha users should avoid decoding untrusted protobuf payloads with\naffected alpha versions or build from a commit containing the fix.\n\n## Fix\n\nThe issue is fixed in Wire `6.3.0`.\n\nThe fix rejects negative lengths while skipping groups and throws `ProtocolException` instead of\nallowing the reader to move to an invalid position and later throw an unchecked runtime exception.\n\n## Credit\n\nReported by @TrekLaps.\n\n## Technical details\n\nThe following technical details are based on the original report, updated by the maintainers to\nreflect the assigned CVE, the supported fixed artifact, and the discontinued status of\n`com.squareup.wire:wire-runtime-jvm`.\n\n`ByteArrayProtoReader32.skipGroup()` in `wire-runtime` did not validate that a\n`LENGTH_DELIMITED` field's length is non-negative before calling `skip()`. A crafted protobuf\nvarint encodes `-128` as a signed `Int`. When `skip(-128)` runs, the internal position counter\nunderflows to an invalid negative position. The next `readByte()` accesses the source with that\nnegative position, throwing `ArrayIndexOutOfBoundsException`, a `RuntimeException` that escapes\nWire's documented `IOException` boundary and can crash the request handler.\n\n`ProtoAdapter.decode(byte[])` is declared to throw `IOException`. Callers following the documented\nAPI may catch only `IOException`, so unchecked runtime exceptions from malformed input can escape\nthe expected error boundary.\n\nThe originally confirmed vulnerable legacy versions include `5.3.1` and `5.3.3` for the\ndiscontinued `com.squareup.wire:wire-runtime-jvm` coordinate. The supported replacement coordinate\nis `com.squareup.wire:wire-runtime`, fixed in version `6.3.0`.\n\n## Root cause\n\nIn the originally reported vulnerable code path, `ByteArrayProtoReader32.skipGroup()` read the\nlength as a signed `Int` and used it without validating that it was non-negative:\n\n```kotlin\nSTATE_LENGTH_DELIMITED -> {\n  val length = internalReadVarint32() // returns signed Int and can be negative\n  skip(length)                        // no negative check\n}\n```\n\nThe internal `skip()` implementation then accepted the negative count because the computed\nposition was not greater than the limit:\n\n```kotlin\nprivate fun skip(byteCount: Int) {\n  val newPos = pos + byteCount        // for example, 7 + (-128) = -121\n  if (newPos > limit) throw EOFException()\n  pos = newPos                        // pos = -121\n}\n```\n\nThe next read could then index the source with the invalid negative position:\n\n```kotlin\nprivate fun readByte(): Byte {\n  if (pos == limit) throw EOFException()\n  return source[pos++]                // source[-121] throws ArrayIndexOutOfBoundsException\n}\n```\n\nWire already rejected negative lengths in normal length-delimited field decoding. The same\nvalidation was missing from group-skipping code.\n\nThe fix adds this validation when skipping groups:\n\n```kotlin\nSTATE_LENGTH_DELIMITED -> {\n  val length = internalReadVarint32()\n  if (length < 0) throw ProtocolException(\"Negative length: $length...\")\n  skip(length)\n}\n```\n\nThe fix was applied to both `ByteArrayProtoReader32.skipGroup()` and `ProtoReader.skipGroup()`.\n\n## Reproduction\n\nThe following reproduction was provided for vulnerable legacy `wire-runtime-jvm` releases such as\n`5.3.1` and `5.3.3`:\n\n```bash\ncurl -sL https://repo1.maven.org/maven2/com/squareup/wire/wire-runtime-jvm/5.3.3/wire-runtime-jvm-5.3.3.jar -o wire.jar\ncurl -sL https://repo1.maven.org/maven2/com/squareup/okio/okio-jvm/3.9.1/okio-jvm-3.9.1.jar -o okio.jar\ncurl -sL https://repo1.maven.org/maven2/org/jetbrains/kotlin/kotlin-stdlib/2.1.0/kotlin-stdlib-2.1.0.jar -o stdlib.jar\n```\n\n```java\n// WirePoc.java\nimport com.squareup.wire.AnyMessage;\n\npublic class WirePoc {\n  public static void main(String[] args) throws Exception {\n    byte[] payload = new byte[] {\n      (byte) 0x9B, 0x06,                                          // field 99, START_GROUP\n      0x0A,                                                       // field 1, LENGTH_DELIMITED\n      (byte) 0x80, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, 0x0F,   // varint = -128\n      (byte) 0x9C, 0x06                                           // field 99, END_GROUP\n    };\n\n    AnyMessage.ADAPTER.decode(payload);\n  }\n}\n```\n\n```bash\njavac -cp \"wire.jar:okio.jar:stdlib.jar\" WirePoc.java\njava -cp \".:wire.jar:okio.jar:stdlib.jar\" WirePoc\n```\n\nObserved output on vulnerable versions:\n\n```text\nException in thread \"main\" java.lang.ArrayIndexOutOfBoundsException: Index -120 out of bounds for length 10\n    at com.squareup.wire.ByteArrayProtoReader32.readByte(ByteArrayProtoReader32.kt:448)\n    at com.squareup.wire.ByteArrayProtoReader32.internalReadVarint32(ByteArrayProtoReader32.kt:294)\n    at com.squareup.wire.ByteArrayProtoReader32.skipGroup(ByteArrayProtoReader32.kt:209)\n    at com.squareup.wire.ByteArrayProtoReader32.nextTag(ByteArrayProtoReader32.kt:156)\n    at com.squareup.wire.AnyMessage$Companion$ADAPTER$1.decode(AnyMessage.kt:150)\n    at com.squareup.wire.AnyMessage$Companion$ADAPTER$1.decode(AnyMessage.kt:88)\n    at com.squareup.wire.ProtoAdapter.decode(ProtoAdapter.kt:468)\n    at WirePoc.main(WirePoc.java:10)\n```\n\nWith the fix, the same payload is rejected with `ProtocolException`.\n\n## Why this can affect any Wire-decoding service\n\n`skipGroup()` is called for any unknown field with wire type 3. An attacker can send an unknown\nfield, such as field 99, with wire type `START_GROUP`. The decoder skips it via `skipGroup()`\nregardless of which message type the service uses, so no schema knowledge is required.\n\nPayload:\n\n```text\n9b060a80ffffff0f9c06\n```\n\nPayload breakdown:\n\n```text\n0x9B 0x06                 field 99, wire type 3 (START_GROUP)\n0x0A                      field 1, wire type 2 (LENGTH_DELIMITED) inside group\n0x80 0xFF 0xFF 0xFF 0x0F  5-byte varint = -128 as signed Int\n0x9C 0x06                 field 99, END_GROUP\n```",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45799"
        },
        {
          "url": "https://github.com/square/wire"
        },
        {
          "url": "https://github.com/square/wire/pull/3595"
        },
        {
          "url": "https://github.com/square/wire/pull/3597"
        },
        {
          "url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7",
          "versions": [
            {
              "version": "4.9.7",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:db0271cb-0d9d-404e-a21e-ea2a9530b441/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#6495fc3b-e5d9-4120-aa4b-1216c61afdd2"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#59feac2b-38e0-49ff-b8cc-8a868edaeedb"
        },
        {
          "ref": "urn:cdx:78593d6d-a377-4c3d-b79a-dbcd5f085b69/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#13935d72-0bb9-4c4f-a492-835860791647"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#042dc713-a7ee-4cda-b663-22f98f0cb24e"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#bddf43db-afb1-4ccb-a86a-197fd375bed0"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#1047fe69-ba13-45df-875a-cb7ac90def18"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#000cbf45-7956-4014-84e2-ddfbbb0023f1"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#9e56a477-fdf8-4ccc-be26-ffb661660aa2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2b608815-ac62-4c7e-97ad-2b0daf83c01b"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#0d056352-801b-4fda-997f-15f06ba2bb33"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#3d8e81ab-986b-43ac-93b1-848db6bc913d"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#18f330d7-6bd4-43d7-974f-ea0ff2545ff3"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#8e8cf59d-ac81-4fea-98c1-803ba75c0c2f"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-46340",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "description": "For each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks.",
      "recommendation": "Upgrade io.netty:netty-transport-sctp to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-46340"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#237701c9-1e67-406c-96e0-952421b82a6e"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#237701c9-1e67-406c-96e0-952421b82a6e"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#58e2d220-fcf8-49df-9cfa-5e01926e9630"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#58e2d220-fcf8-49df-9cfa-5e01926e9630"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4a889dc3-e689-43b5-be03-b0879fdb1620"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#4a889dc3-e689-43b5-be03-b0879fdb1620"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0a244214-b6ea-4917-ac5e-e050ef279396"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#0a244214-b6ea-4917-ac5e-e050ef279396"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18f8b9bc-1095-486a-8dfc-17b92bac4abf"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#18f8b9bc-1095-486a-8dfc-17b92bac4abf"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0ce9338c-3ea8-448a-a45e-a08bc875a16c"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#0ce9338c-3ea8-448a-a45e-a08bc875a16c"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#195a07ca-4099-4a3f-ab8e-56c1fd2d3f0f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#195a07ca-4099-4a3f-ab8e-56c1fd2d3f0f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#ea4b7071-cff5-4f49-a09d-00b22cefcc6d"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#ea4b7071-cff5-4f49-a09d-00b22cefcc6d"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#19615ed6-08d9-4335-a59a-7c2589aea403"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#19615ed6-08d9-4335-a59a-7c2589aea403"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-transport-sctp@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#50a51cb6-1dd2-4e13-9482-695e6239c570"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#50a51cb6-1dd2-4e13-9482-695e6239c570"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#b733ffbe-eefb-438f-a4e0-ab9e0a59b24d"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#b733ffbe-eefb-438f-a4e0-ab9e0a59b24d"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2ccd0c02-a71f-42ee-9522-47e3881bef9f"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#2ccd0c02-a71f-42ee-9522-47e3881bef9f"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4cee5e35-aa80-4cfe-ba9e-412d4475cae0"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#4cee5e35-aa80-4cfe-ba9e-412d4475cae0"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#026e72d0-1eb7-4cea-af3c-d106d36edea8"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#026e72d0-1eb7-4cea-af3c-d106d36edea8"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#517b1f44-a942-4e55-83bd-f9f2291113c4"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#517b1f44-a942-4e55-83bd-f9f2291113c4"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#16723af5-4ad8-40c4-a409-d0626774bbf1"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#16723af5-4ad8-40c4-a409-d0626774bbf1"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-47244",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "description": "### Impact\nDefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work.\n\n### Resources\nhttps://www.rfc-editor.org/rfc/rfc7540.html#section-6.5.2",
      "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-47244"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#709830ae-9af6-4db2-a3d1-298ef59d7df3"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#709830ae-9af6-4db2-a3d1-298ef59d7df3"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#7ad5921a-8236-41c9-82f9-57e26f88aba4"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#7ad5921a-8236-41c9-82f9-57e26f88aba4"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8853b998-b2fe-4016-a2a3-c102c8a06c65"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#8853b998-b2fe-4016-a2a3-c102c8a06c65"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#23013092-4ff3-46c8-837e-8a85e8a2ef5e"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#23013092-4ff3-46c8-837e-8a85e8a2ef5e"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#057e3949-6862-4ad3-a797-9b72134e4f0b"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#057e3949-6862-4ad3-a797-9b72134e4f0b"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#2b02b850-0f21-4942-908e-9e88849d337f"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#2b02b850-0f21-4942-908e-9e88849d337f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#173f2853-5eff-440e-9718-b743a4c7bc6f"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#173f2853-5eff-440e-9718-b743a4c7bc6f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1d4c097d-034f-4081-b9b7-931613cc14d2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#1d4c097d-034f-4081-b9b7-931613cc14d2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#701bbf52-9fc9-4054-b3e2-b3355713804a"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#701bbf52-9fc9-4054-b3e2-b3355713804a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#5346ff76-2aff-4d62-9675-a959f5b38a9a"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#5346ff76-2aff-4d62-9675-a959f5b38a9a"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#642b2d00-187e-4209-94fd-12eecaf9e384"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#642b2d00-187e-4209-94fd-12eecaf9e384"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#36fdba8b-d76e-4ba6-8771-7dfcd2d825c1"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#36fdba8b-d76e-4ba6-8771-7dfcd2d825c1"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#09f83b07-35d1-4211-a43a-df5c80ad3962"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#09f83b07-35d1-4211-a43a-df5c80ad3962"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#07789c81-94f8-4d8d-b484-57cbd3079c69"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#07789c81-94f8-4d8d-b484-57cbd3079c69"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#19c5a50b-3df4-4b68-b3ff-05830b83c82d"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#19c5a50b-3df4-4b68-b3ff-05830b83c82d"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6c8a6e01-3d5c-4f9c-b1c7-04180b4274da"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#6c8a6e01-3d5c-4f9c-b1c7-04180b4274da"
        }
      ]
    },
    {
      "id": "CVE-2026-47691",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 8.7,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
        }
      ],
      "description": "### Summary\nNetty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`).\n\n### Details\nIn `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName.\n\nThis means if the resolver queries evil.co.uk., it will accept an NS record claiming authority over co.uk.. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key (co.uk.). This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under co.uk..\n\nThe `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#cache` method only prevents caching if the record is for the root zone (dots == 1).\n\n### Impact\nDNS Cache Poisoning. Any application using Netty's DNS resolver is impacted.",
      "recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-47691"
        },
        {
          "url": "https://github.com/netty/netty"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
        }
      ],
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final",
          "versions": [
            {
              "version": "4.1.130.Final",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2456cb17-4ffd-4039-a938-17f4c90f19b2"
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#2456cb17-4ffd-4039-a938-17f4c90f19b2"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5c951a33-2994-4605-9856-03784aa39de5"
        },
        {
          "ref": "urn:cdx:6a63cf73-7a1e-4817-a511-538c179567e9/1#5c951a33-2994-4605-9856-03784aa39de5"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#ba451751-ac80-4830-bd27-96274ecffacc"
        },
        {
          "ref": "urn:cdx:9509694b-0af7-452a-b031-25aaf330e46d/1#ba451751-ac80-4830-bd27-96274ecffacc"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1d16622e-16e3-4cc7-90d9-3f5fec38fa65"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#1d16622e-16e3-4cc7-90d9-3f5fec38fa65"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#9095d426-d154-4b5a-a224-a5e060a1b862"
        },
        {
          "ref": "urn:cdx:1f58e9e6-a2f1-4cc0-8d15-f747a3f1160e/1#9095d426-d154-4b5a-a224-a5e060a1b862"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#32b4ba41-cf70-412b-a895-664eb06ac5e2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#32b4ba41-cf70-412b-a895-664eb06ac5e2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#66b96533-1fea-4046-b266-6333efc96135"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#66b96533-1fea-4046-b266-6333efc96135"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#b5ec9ef5-8d76-4872-8533-2f919eaa4d6f"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#b5ec9ef5-8d76-4872-8533-2f919eaa4d6f"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#1d529033-cf74-4dc5-b920-28540402a6c5"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#1d529033-cf74-4dc5-b920-28540402a6c5"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#12a684ce-506e-48c1-8e1b-26cf87898057"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#12a684ce-506e-48c1-8e1b-26cf87898057"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.netty/netty-resolver-dns@4.1.130.Final"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4fb793df-af1e-4e33-a682-cea7dd5f777e"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#4fb793df-af1e-4e33-a682-cea7dd5f777e"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#5085e54a-46aa-4d19-9d32-75f8f3e319a7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#5085e54a-46aa-4d19-9d32-75f8f3e319a7"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3cb7de17-f368-4392-af56-a1e490970b7a"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#3cb7de17-f368-4392-af56-a1e490970b7a"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#19ae58c0-5fb5-4c9a-a46e-2e12749801c9"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#19ae58c0-5fb5-4c9a-a46e-2e12749801c9"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14f561ef-b5b8-4949-95a3-dd06fe8df6a7"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#14f561ef-b5b8-4949-95a3-dd06fe8df6a7"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#5268c472-d1bd-4a13-b0a9-89cfcfbe291b"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#5268c472-d1bd-4a13-b0a9-89cfcfbe291b"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-8149",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [],
      "cwes": [
        1068
      ],
      "description": "A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS on Linux, X86_64, AVX, AVX-512f.\n\n This vulnerability is associated with program files gcm128w, gcm512w.\n\n\n\nThis issue affects BC-LTS: from 2.73.0 before 2.73.11.",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-8149"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908149"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8149"
        }
      ],
      "published": "2026-05-08T07:16:29+00:00",
      "updated": "2026-05-19T00:16:37+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bc-fips@2.1.2",
          "versions": [
            {
              "version": "2.1.2",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:216a542d-6343-421e-8398-d5e9ea5d555a/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:3a6520bc-5490-4777-932d-cc18f042793b/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:5a8381eb-07ee-45de-8152-b9898a644d65/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#49b739b8-c3e2-4788-a71e-1fd41f20b4c4"
        },
        {
          "ref": "urn:cdx:3591e125-300b-4fcf-881a-737ccd1bb73f/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:d2cebb7a-9b9b-43b6-b8fe-d7b07225f0f9/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#87295dd5-93c2-4988-9c48-8f05449dd007"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#0908a00d-0eb3-45ca-ae24-b28dcc53547a"
        },
        {
          "ref": "urn:cdx:7bf4494d-9f88-42ab-a363-76fd4d028eb8/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#3f4ee27d-0050-428a-8d20-be17d6a0760f"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#1c8bad34-d042-46fc-a70c-f81d46456837"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#6e2e77c7-a819-4aad-9696-d781539da720"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#69e9a102-bebf-4250-a29e-9096b9fe8db8"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#05fe3751-8330-4a2a-b696-5e4c1e8af6d9"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#0bfb3877-70ca-4e64-97f4-453d0053ed36"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#045c0408-1ce9-407b-abe6-e053a725260d"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    },
    {
      "id": "CVE-2026-33117",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 9.1,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "cwes": [
        287,
        347
      ],
      "description": "Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network.",
      "recommendation": "Upgrade com.azure:azure-security-keyvault-keys to version 4.10.6",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-33117"
        },
        {
          "url": "https://github.com/Azure/azure-sdk-for-java"
        },
        {
          "url": "https://github.com/Azure/azure-sdk-for-java/commit/1b5c5c79d85a5c9a9cfd07f6cdff6fd0f50eccf9"
        },
        {
          "url": "https://github.com/Azure/azure-sdk-for-java/pull/48476"
        },
        {
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33117"
        }
      ],
      "published": "2026-05-12T18:17:04+00:00",
      "updated": "2026-05-15T18:38:17+00:00",
      "affects": [
        {
          "ref": "pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2",
          "versions": [
            {
              "version": "4.9.2",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:4e8e9348-8ecd-44a9-812b-a3cdba11d58d/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-45205",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        674
      ],
      "description": "Uncontrolled Recursion vulnerability in Apache Commons.\n\nWhen processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles.\nThis issue affects Apache Commons: from 2.2 before 2.15.0.\n\nUsers are recommended to upgrade to version 2.15.0, which fixes the issue.",
      "recommendation": "Upgrade org.apache.commons:commons-configuration2 to version 2.15.0",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-45205"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2026/05/14/5"
        },
        {
          "url": "https://github.com/apache/commons-configuration"
        },
        {
          "url": "https://github.com/apache/commons-configuration/pull/634"
        },
        {
          "url": "https://lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45205"
        }
      ],
      "published": "2026-05-14T12:16:35+00:00",
      "updated": "2026-05-15T18:40:16+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0",
          "versions": [
            {
              "version": "2.11.0",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:960aea3a-0994-4d9e-b12a-2f30aaaedfb5/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:ace1d443-7c9d-4e08-ac34-ce44812c5c47/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:3de817b9-b7ea-45c7-b4fa-01ec492456f2/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:maven/org.apache.commons/commons-configuration2@2.11.0"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-6860",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "ghsa"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "cwes": [
        770,
        295
      ],
      "description": "A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.",
      "recommendation": "Upgrade io.vertx:vertx-core to version 4.5.27, 5.0.12",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-6860"
        },
        {
          "url": "https://github.com/eclipse-vertx/vert.x"
        },
        {
          "url": "https://github.com/eclipse-vertx/vert.x/pull/6102"
        },
        {
          "url": "https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6"
        },
        {
          "url": "https://github.com/vert-x3/wiki/wiki/4.5.27-Release-Notes"
        },
        {
          "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6860"
        },
        {
          "url": "https://vertx.io/blog/eclipse-vert-x-4-5-27"
        },
        {
          "url": "https://vertx.io/blog/eclipse-vert-x-5-0-12"
        }
      ],
      "published": "2026-05-06T10:16:26+00:00",
      "updated": "2026-05-12T13:42:01+00:00",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.24",
          "versions": [
            {
              "version": "4.5.24",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:1f989e8c-d401-4478-8d97-5319e3d958a6/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:3e5e843b-9a1f-48a2-b53d-444ea702640f/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:aae67e3d-1856-44e4-9706-20cca2bc5fd5/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:f5cb8efd-9f02-42ef-ae00-2645090cc852/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#2ce290ac-882e-4f5f-ac1d-f4587e7feaf7"
        },
        {
          "ref": "urn:cdx:95ab98a6-54c3-41ad-908a-82c2967925dc/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:777f8a95-614d-45f2-a480-0a8dd489dc88/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:4e0c8819-e437-45bc-aacb-4887caffef88/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:7a68b73e-2ae5-45b0-8935-a81be95c383b/1#pkg:maven/io.vertx/vertx-core@4.5.24"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#754687b9-b594-488a-8dca-25cb24553ee7"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-0636",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "cwes": [
        90
      ],
      "description": "Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.",
      "recommendation": "Upgrade org.bouncycastle:bcprov-jdk18on to version 1.84",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-0636"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-0636"
        },
        {
          "url": "https://github.com/bcgit/bc-java"
        },
        {
          "url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
        }
      ],
      "published": "2026-04-15T10:16:38+00:00",
      "updated": "2026-05-19T00:16:36+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82",
          "versions": [
            {
              "version": "1.82",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5588",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "amazon"
          },
          "severity": "medium"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "cwes": [
        327
      ],
      "description": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).\n\n This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.",
      "recommendation": "Upgrade org.bouncycastle:bcpkix-jdk18on to version 1.84",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5588"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5588"
        },
        {
          "url": "https://github.com/bcgit/bc-java"
        },
        {
          "url": "https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
        }
      ],
      "published": "2026-04-15T10:16:49+00:00",
      "updated": "2026-05-19T00:16:37+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.82",
          "versions": [
            {
              "version": "1.82",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.82"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "",
        "response": [
          "update"
        ],
        "detail": null
      }
    },
    {
      "id": "CVE-2026-5598",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [
        {
          "source": {
            "name": "redhat"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "cwes": [
        385
      ],
      "description": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).\n\n This vulnerability is associated with program files FrodoEngine.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.80.1, from 1.82 before 1.84.",
      "recommendation": "Upgrade org.bouncycastle:bcprov-jdk18on to version 1.84",
      "advisories": [
        {
          "url": "https://avd.aquasec.com/nvd/cve-2026-5598"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-5598"
        },
        {
          "url": "https://github.com/bcgit/bc-java"
        },
        {
          "url": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5"
        },
        {
          "url": "https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-5598"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
        }
      ],
      "published": "2026-04-15T10:16:49+00:00",
      "updated": "2026-05-19T00:16:37+00:00",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82",
          "versions": [
            {
              "version": "1.82",
              "status": "affected"
            }
          ]
        },
        {
          "ref": "urn:cdx:c5577c7d-15dd-4b05-918f-f38350f49f60/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:a703ec34-dd5a-4b7e-993c-dadf9cd1cc3c/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:30bfd6c8-4946-484c-8826-f1ba3e63b972/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:a9939e19-f6b5-470b-9627-a4e9c8c83456/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:34dffd68-09a6-40bf-a56f-260eb3f3512f/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        },
        {
          "ref": "urn:cdx:6ff7e8ce-5e82-4743-9d33-f8edb1b5c513/1#pkg:maven/org.bouncycastle/bcprov-jdk18on@1.82"
        }
      ],
      "analysis": {
        "state": "in_triage",
        "justification": "",
        "response": [],
        "detail": "This CVE is under investigation by Confluent."
      }
    }
  ],
  "component": []
}