{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ec6bbf53-b411-4b86-9a88-156a822d78ed", "version": 1, "metadata": { "timestamp": "2026-10-09T15:08:37+00:00", "tools": { "components": [ { "type": "application", "manufacturer": { "name": "Aqua Security Software Ltd." }, "group": "aquasecurity", "name": "trivy", "version": "0.69.3" } ] }, "component": { "bom-ref": "pkg:oci/cp-usm-agent@sha256%3A297a82e19ae48aa6da79c0afee9baa08ecadecf973613f3c2a1cad00db12b241?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-usm-agent", "type": "container", "supplier": { "name": "Confluent" }, "name": "cp-usm-agent", "version": "1.2.1", "purl": "pkg:oci/cp-usm-agent@sha256%3A297a82e19ae48aa6da79c0afee9baa08ecadecf973613f3c2a1cad00db12b241?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-usm-agent", "properties": [ { "name": "aquasecurity:trivy:DiffID", "value": "sha256:0a082193fa5a9a8693c46b7a269911de4444b4d35da8808cf5eb85924a40004d" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:1cf76d0905df84b47ed9ac1263ee36d8ebb7b8c94f10a708f89dfb34cffdc1c1" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:5fcced3f5ffa3f446004b1c891664f3c0781a066c0e89ddaba5702fd59612db7" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:643c9728f980fc215c2b9b55264396469dc9ba57ed4f00194710e5a841d444c1" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:77f7475504034841b37acfc8e55ba5ee65d0bb808ae12b1c0f440c72d49549a8" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:838c5920f46f38426b94f2830a8a16c9bb864f90e7b6dde8ded7f1466e16b2af" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:85aa77e1b988c5dd61cfe4e5316c5b2152439fcf43838d475c28f904621cc853" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:c3185217fc75ab77b16e5e744e389a5bf8b7270bbe1a0f66b479eba2c702abb7" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:e3127fcc5a4e4237d24cd2d3e6fcf7922653e801437218c5a8d525621a6fcbd9" }, { "name": "aquasecurity:trivy:ImageID", "value": "sha256:b3829e9e4a90288e9082adbbb1d56c204ef51339ad866dcd2235deb1bd4331fa" }, { "name": "aquasecurity:trivy:Labels:architecture", "value": "x86_64" }, { "name": "aquasecurity:trivy:Labels:build-date", "value": "2026-08-10T00:33:42Z" }, { "name": "aquasecurity:trivy:Labels:com.redhat.component", "value": "ubi9-micro-container" }, { "name": "aquasecurity:trivy:Labels:com.redhat.license_terms", "value": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI" }, { "name": "aquasecurity:trivy:Labels:cpe", "value": "cpe:/a:redhat:enterprise_linux:9::appstream" }, { "name": "aquasecurity:trivy:Labels:description", "value": "Confluent USM Agent provides single egress for metrics and metadata events generated in CP components that are sent to Confluent Cloud." }, { "name": "aquasecurity:trivy:Labels:distribution-scope", "value": "public" }, { "name": "aquasecurity:trivy:Labels:io.buildah.version", "value": "1.44.0" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker", "value": "true" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker.build.number", "value": "be70c7cd" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker.git.id", "value": "c21cc18" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker.git.repo", "value": "confluentinc/usm-agent-images" }, { "name": "aquasecurity:trivy:Labels:io.k8s.description", "value": "Very small image which doesn't install the package manager." }, { "name": "aquasecurity:trivy:Labels:io.k8s.display-name", "value": "Red Hat Universal Base Image 9 Micro" }, { "name": "aquasecurity:trivy:Labels:maintainer", "value": "partner-support@confluent.io" }, { "name": "aquasecurity:trivy:Labels:name", "value": "cp-usm-agent" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.created", "value": "2026-08-10T00:33:42Z" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", "value": "c8309b9e25548e72dcbeeb10bd939b0579e17e6a" }, { "name": "aquasecurity:trivy:Labels:release", "value": "1.2.1-9" }, { "name": "aquasecurity:trivy:Labels:summary", "value": "Confluent USM Agent provides single egress for metrics and metadata events generated in CP components that are sent to Confluent Cloud." }, { "name": "aquasecurity:trivy:Labels:url", "value": "https://catalog.redhat.com/en/search?searchType=containers" }, { "name": "aquasecurity:trivy:Labels:vcs-ref", "value": "c8309b9e25548e72dcbeeb10bd939b0579e17e6a" }, { "name": "aquasecurity:trivy:Labels:vcs-type", "value": "git" }, { "name": "aquasecurity:trivy:Labels:vendor", "value": "Confluent" }, { "name": "aquasecurity:trivy:Labels:version", "value": "c21cc18" }, { "name": "aquasecurity:trivy:Reference", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-usm-agent:1.2.1-rc260819093336-latest-ubi9" }, { "name": "aquasecurity:trivy:RepoDigest", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-usm-agent@sha256:297a82e19ae48aa6da79c0afee9baa08ecadecf973613f3c2a1cad00db12b241" }, { "name": "aquasecurity:trivy:RepoTag", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-usm-agent:1.2.1-rc260819093336-latest-ubi9" }, { "name": "aquasecurity:trivy:SchemaVersion", "value": "2" }, { "name": "aquasecurity:trivy:Size", "value": "163585536" } ] } }, "components": [], "dependencies": [], "vulnerabilities": [ { "id": "CVE-2021-46195", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 674 ], "description": "GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "url": "https://access.redhat.com/errata/RHSA-2022:8415" }, { "url": "https://access.redhat.com/security/cve/CVE-2021-46195" }, { "url": "https://bugzilla.redhat.com/2046300" }, { "url": "https://errata.almalinux.org/9/ALSA-2022-8415.html" }, { "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841" }, { "url": "https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=f10bec5ffa487ad3033ed5f38cfd0fc7d696deab" }, { "url": "https://linux.oracle.com/cve/CVE-2021-46195.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2022-8415.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46195" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-46195" } ], "published": "2022-01-14T20:15:15+00:00", "updated": "2026-10-08T22:17:14+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in USM-Agent. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2022-27943", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 674 ], "description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-27943" }, { "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead" }, { "url": "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27943" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-27943" } ], "published": "2022-03-26T13:15:07+00:00", "updated": "2026-10-08T19:16:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in USM-Agent. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2022-41409", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 190 ], "description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-41409" }, { "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35" }, { "url": "https://github.com/PCRE2Project/pcre2/issues/141" }, { "url": "https://github.com/advisories/GHSA-4qfx-v7wh-3q4j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-41409" } ], "published": "2023-07-18T14:15:12+00:00", "updated": "2026-06-17T05:03:09+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in USM-Agent. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2023-50495", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-50495" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50495" }, { "url": "https://security.netapp.com/advisory/ntap-20240119-0008/" }, { "url": "https://ubuntu.com/security/notices/USN-6684-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-50495" } ], "published": "2023-12-12T15:15:07+00:00", "updated": "2026-06-17T06:39:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in USM-Agent. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-102010", "ratings": [ { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "cwes": [ 825 ], "description": "A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "url": "https://access.redhat.com/errata/RHSA-2026:73642" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74569" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-102010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478395" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102010" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-102010" } ], "published": "2026-09-28T19:16:48+00:00", "updated": "2026-10-02T03:16:38+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-103111", "ratings": [ { "source": { "name": "redhat" }, "score": 7.6, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L" } ], "cwes": [ 787 ], "description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-103111" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103111" } ], "published": "2026-09-30T05:16:45+00:00", "updated": "2026-10-04T00:16:35+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-18374", "ratings": [ { "source": { "name": "redhat" }, "score": 4.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/27/6" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-18374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18374" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34574" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0015" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18374" } ], "published": "2026-08-27T20:17:03+00:00", "updated": "2026-09-03T16:43:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-19542", "ratings": [ { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-19542" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19542" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34506" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19542" } ], "published": "2026-09-14T18:17:46+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-54371", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 59 ], "description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "recommendation": "Upgrade libattr to version 2.6.0-1.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/2490283" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54371" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60226.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60226" }, { "url": "https://linux.oracle.com/cve/CVE-2026-54371.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-60226-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54371" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://ubuntu.com/security/notices/USN-8691-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54371" }, { "url": "https://www.openwall.com/lists/oss-security/2026/06/29/1" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" } ], "published": "2026-06-29T14:16:57+00:00", "updated": "2026-09-11T13:18:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.1-3.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in USM-Agent. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-56391", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "GNU coreutils uniq is vulnerable to an out\u2011of\u2011bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67886" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56391" }, { "url": "https://bugzilla.redhat.com/2506691" }, { "url": "https://bugzilla.redhat.com/2506694" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506694" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-56391" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56391" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56392" }, { "url": "https://errata.almalinux.org/10/ALSA-2026-67886.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:67886" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371" }, { "url": "https://github.com/advisories/GHSA-7xvj-m9x7-qgxq" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56391.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-67886.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56391" }, { "url": "https://ubuntu.com/security/notices/USN-8697-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56391" }, { "url": "https://www.openwall.com/lists/oss-security/2026/07/25/2" } ], "published": "2026-07-24T09:16:25+00:00", "updated": "2026-08-26T13:52:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56392", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 122 ], "description": "GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out\u2011of\u2011bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d", "recommendation": "Upgrade coreutils-single to version 8.32-41.el9_8.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66403" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56392" }, { "url": "https://bugzilla.redhat.com/2506694" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506694" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-56391" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56392" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-66403.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:66403" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d" }, { "url": "https://github.com/advisories/GHSA-g24f-m2hx-pfgx" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56392.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-67886.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56392" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56392" } ], "published": "2026-07-24T09:16:25+00:00", "updated": "2026-10-02T13:57:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56851", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "cwes": [ 787 ], "description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "recommendation": "Upgrade golang.org/x/text to version 0.41.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56851" }, { "url": "https://go.dev/cl/793360" }, { "url": "https://go.dev/issue/80112" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6629" } ], "published": "2026-10-07T18:17:20+00:00", "updated": "2026-10-08T21:35:53+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/text@v0.39.0", "versions": [ { "version": "v0.39.0", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/golang.org/x/text@v0.39.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56857", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "url": "https://go.dev/cl/847305" }, { "url": "https://go.dev/issue/81739" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6604" } ], "published": "2026-10-08T23:17:01+00:00", "updated": "2026-10-08T23:17:01+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56866", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "url": "https://go.dev/cl/847306" }, { "url": "https://go.dev/issue/81740" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6605" } ], "published": "2026-10-08T23:17:01+00:00", "updated": "2026-10-08T23:17:01+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-6368", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 908 ], "description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43\u00a0can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "url": "https://access.redhat.com/errata/RHSA-2026:76777" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6368" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513603" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513608" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6368" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6791" }, { "url": "https://errata.almalinux.org/8/ALSA-2026-76777.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:76777" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6368" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34090" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6368" } ], "published": "2026-08-10T19:17:30+00:00", "updated": "2026-09-03T16:43:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-6791", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "url": "https://access.redhat.com/errata/RHSA-2026:76777" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6791" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513603" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513608" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6368" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6791" }, { "url": "https://errata.almalinux.org/8/ALSA-2026-76777.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:76777" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6791" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34091" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0013" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6791" } ], "published": "2026-08-10T19:17:30+00:00", "updated": "2026-09-03T16:43:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-77117", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 835 ], "description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-77117" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77117" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34556" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-77117" } ], "published": "2026-09-15T11:17:12+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-78659", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0; Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "url": "https://go.dev/cl/847185" }, { "url": "https://go.dev/cl/847314" }, { "url": "https://go.dev/issue/81857" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6603" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.56.0", "versions": [ { "version": "v0.56.0", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/golang.org/x/net@v0.56.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-78660", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0; Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "url": "https://go.dev/cl/835145" }, { "url": "https://go.dev/cl/836385" }, { "url": "https://go.dev/issue/81115" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6610" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.56.0", "versions": [ { "version": "v0.56.0", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/golang.org/x/net@v0.56.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-78663", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0; Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "url": "https://go.dev/cl/847187" }, { "url": "https://go.dev/cl/847310" }, { "url": "https://go.dev/issue/81743" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6612" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.56.0", "versions": [ { "version": "v0.56.0", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/golang.org/x/net@v0.56.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-78667", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-78667" }, { "url": "https://go.dev/cl/847309" }, { "url": "https://go.dev/issue/81858" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6609" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-78667" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-78669", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0; Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "url": "https://go.dev/cl/847186" }, { "url": "https://go.dev/cl/847308" }, { "url": "https://go.dev/issue/81742" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6611" } ], "published": "2026-10-08T23:17:04+00:00", "updated": "2026-10-08T23:17:04+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.56.0", "versions": [ { "version": "v0.56.0", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/golang.org/x/net@v0.56.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-80489", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 835 ], "description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-80489" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80489" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34568" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-80489" } ], "published": "2026-09-15T11:17:12+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-84303", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "ratings": [], "cwes": [ 178, 863 ], "description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.", "recommendation": "Upgrade google.golang.org/grpc to version 1.83.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "url": "https://github.com/grpc/grpc-go" }, { "url": "https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8" }, { "url": "https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe" }, { "url": "https://github.com/grpc/grpc-go/pull/9332" }, { "url": "https://github.com/grpc/grpc-go/pull/9335" }, { "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.1" }, { "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84303" } ], "published": "2026-09-01T19:17:30+00:00", "updated": "2026-09-09T21:09:13+00:00", "affects": [ { "ref": "pkg:golang/google.golang.org/grpc@v1.82.1", "versions": [ { "version": "v1.82.1", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/google.golang.org/grpc@v1.82.1" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-84304", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400 ], "description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.", "recommendation": "Upgrade google.golang.org/grpc to version 1.83.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-84304" }, { "url": "https://github.com/grpc/grpc-go" }, { "url": "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176" }, { "url": "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77" }, { "url": "https://github.com/grpc/grpc-go/pull/9331" }, { "url": "https://github.com/grpc/grpc-go/pull/9333" }, { "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.1" }, { "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84304" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-84304" } ], "published": "2026-09-01T19:17:30+00:00", "updated": "2026-09-09T21:09:13+00:00", "affects": [ { "ref": "pkg:golang/google.golang.org/grpc@v1.82.1", "versions": [ { "version": "v1.82.1", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/google.golang.org/grpc@v1.82.1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the USM-Agent. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. google.golang.org/grpc is pulled in only transitively through OTLP proto message definitions used for data structures, and no shipped binary ever establishes a gRPC client or server connection, so the vulnerable HTTP/2 DATA-frame transport code path is never reached." } }, { "id": "CVE-2026-84445", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 129, 248 ], "description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.", "recommendation": "Upgrade google.golang.org/grpc to version 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "url": "https://access.redhat.com/errata/RHSA-2026:76744" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-84445" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84445" }, { "url": "https://errata.rockylinux.org/RLSA-2026:76744" }, { "url": "https://github.com/grpc/grpc-go" }, { "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7" }, { "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4" }, { "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f" }, { "url": "https://github.com/grpc/grpc-go/issues/9354" }, { "url": "https://github.com/grpc/grpc-go/pull/9365" }, { "url": "https://github.com/grpc/grpc-go/pull/9366" }, { "url": "https://github.com/grpc/grpc-go/pull/9367" }, { "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2" }, { "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2" }, { "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-84445" } ], "published": "2026-09-14T17:17:51+00:00", "updated": "2026-09-25T14:10:13+00:00", "affects": [ { "ref": "pkg:golang/google.golang.org/grpc@v1.82.1", "versions": [ { "version": "v1.82.1", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/google.golang.org/grpc@v1.82.1" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-86145", "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 424 ], "description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/05/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86145" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86145" } ], "published": "2026-09-05T06:17:10+00:00", "updated": "2026-09-09T16:04:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-8674", "ratings": [ { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 617 ], "description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/17/4" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-8674" }, { "url": "https://joshua.hu/fuzzing-glibc-libresolv" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8674" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31026" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-8674" } ], "published": "2026-09-17T17:16:53+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-86805", "ratings": [ { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 367 ], "description": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86805" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86805" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34360" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86805" } ], "published": "2026-09-22T16:18:06+00:00", "updated": "2026-09-23T04:17:57+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-89092", "ratings": [ { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 789 ], "description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.\u00a0 During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.\u00a0 In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/11/2" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89092" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89092" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34624" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0016" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89092" } ], "published": "2026-09-11T02:18:35+00:00", "updated": "2026-09-11T18:17:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-89156", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 125 ], "description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89156" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89156" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89156" } ], "published": "2026-09-11T04:18:03+00:00", "updated": "2026-09-16T19:27:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-89157", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": { "name": "redhat" }, "score": 5.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" } ], "cwes": [ 190 ], "description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89157" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89157" } ], "published": "2026-09-11T04:18:03+00:00", "updated": "2026-09-16T19:25:08+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-89158", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" } ], "cwes": [ 190 ], "description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89158" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89158" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89158" } ], "published": "2026-09-11T04:18:03+00:00", "updated": "2026-09-16T19:23:41+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-89160", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 125 ], "description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89160" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89160" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89160" } ], "published": "2026-09-11T04:18:04+00:00", "updated": "2026-09-16T19:15:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-89161", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 590 ], "description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89161" } ], "published": "2026-09-11T04:18:04+00:00", "updated": "2026-09-16T19:10:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-94439", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "description": "When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-94439" }, { "url": "https://go.dev/cl/847311" }, { "url": "https://go.dev/issue/81744" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94439" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6613" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94439" } ], "published": "2026-10-08T23:17:04+00:00", "updated": "2026-10-08T23:17:04+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-94440", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "url": "https://go.dev/cl/847307" }, { "url": "https://go.dev/issue/81741" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6608" } ], "published": "2026-10-08T23:17:04+00:00", "updated": "2026-10-08T23:17:04+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-94448", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "url": "https://go.dev/cl/839866" }, { "url": "https://go.dev/issue/81821" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6599" } ], "published": "2026-10-08T23:17:05+00:00", "updated": "2026-10-08T23:17:05+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-95619", "ratings": [ { "source": { "name": "redhat" }, "score": 7.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58503" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67275" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-95619" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537811" }, { "url": "https://gcc.gnu.org/pipermail/gcc-patches/2026-September/732381.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95619" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95619" } ], "published": "2026-09-22T13:17:13+00:00", "updated": "2026-09-22T19:37:36+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-95818", "ratings": [ { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 121 ], "description": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-95818" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95818" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34360" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95818" } ], "published": "2026-09-22T17:17:32+00:00", "updated": "2026-09-22T19:56:19+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-97030", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "url": "https://go.dev/cl/840925" }, { "url": "https://go.dev/issue/81823" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6600" } ], "published": "2026-10-08T23:17:05+00:00", "updated": "2026-10-08T23:17:05+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-97031", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97031" }, { "url": "https://go.dev/cl/847312" }, { "url": "https://go.dev/issue/81855" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6607" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97031" } ], "published": "2026-10-08T23:17:06+00:00", "updated": "2026-10-08T23:17:06+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-97032", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0; Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97032" }, { "url": "https://go.dev/cl/847188" }, { "url": "https://go.dev/cl/847313" }, { "url": "https://go.dev/issue/81867" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97032" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6617" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97032" } ], "published": "2026-10-08T23:17:06+00:00", "updated": "2026-10-08T23:17:06+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.13", "versions": [ { "version": "v1.25.13", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.56.0", "versions": [ { "version": "v0.56.0", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/stdlib@v1.25.13" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:golang/golang.org/x/net@v0.56.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-97399", "ratings": [ { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 126 ], "description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/28/7" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97399" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97399" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34683" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97399" } ], "published": "2026-09-28T16:17:18+00:00", "updated": "2026-09-29T21:36:39+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:10ffde00-bba2-4fe9-95c5-f53b21bbb940/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } } ] }