{"grype_matches":[{"artifact":{"id":"ecae56e691f56928","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=rhel-9.8&upstream=ncurses-6.2-12.20210508.el9.src.rpm","type":"rpm","version":"6.2-12.20210508.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.2-12.20210508.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"ncurses","version":"6.2-12.20210508.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-19","epss":0.01037,"percentile":0.63355}],"risk":0.49257500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-50495","description":"A vulnerability was found in the NCurses package, where a segmentation fault may be triggered through _nc_wrap_entry()."},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-19","epss":0.01037,"percentile":0.63355}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"b0fd3764b473721b","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=rhel-9.8&upstream=ncurses-6.2-12.20210508.el9.src.rpm","type":"rpm","version":"6.2-12.20210508.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.2-12.20210508.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"ncurses","version":"6.2-12.20210508.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-19","epss":0.01037,"percentile":0.63355}],"risk":0.49257500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-50495","description":"A vulnerability was found in the NCurses package, where a segmentation fault may be triggered through _nc_wrap_entry()."},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-19","epss":0.01037,"percentile":0.63355}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"6709e32e10ce5a81","cpes":["cpe:2.3:a:redhat:pcre2:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.40-7.el9_8:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.40-7.el9_8?arch=x86_64&distro=rhel-9.8&upstream=pcre2-10.40-7.el9_8.src.rpm","type":"rpm","version":"10.40-7.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"pcre2","version":"0:10.40-7.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-10-19","epss":0.01121,"percentile":0.65687}],"risk":0.465215,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-41409","description":"A flaw was found in PCRE2, where it is susceptible to an integer overflow vulnerability triggered by a negative repeat value in the pcre2test subject line that causes infinite looping. This flaw allows a remote attacker to pass specially crafted data to the application, initiating an integer overflow and executing a denial of service (DoS) attack."},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-10-19","epss":0.01121,"percentile":0.65687}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"564863bbdb4b6c77","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.40-7.el9_8?arch=noarch&distro=rhel-9.8&upstream=pcre2-10.40-7.el9_8.src.rpm","type":"rpm","version":"10.40-7.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.40-7.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"pcre2","version":"10.40-7.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-10-19","epss":0.01121,"percentile":0.65687}],"risk":0.465215,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-41409","description":"A flaw was found in PCRE2, where it is susceptible to an integer overflow vulnerability triggered by a negative repeat value in the pcre2test subject line that causes infinite looping. This flaw allows a remote attacker to pass specially crafted data to the application, initiating an integer overflow and executing a denial of service (DoS) attack."},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-10-19","epss":0.01121,"percentile":0.65687}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"23e3d9feac1cb13c","cpes":["cpe:2.3:a:libgcc:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=rhel-9.8&upstream=gcc-11.5.0-14.el9.src.rpm","type":"rpm","version":"11.5.0-14.el9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-14.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"gcc","version":"11.5.0-14.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-10-19","epss":0.00953,"percentile":0.60694}],"risk":0.4050250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-27943","description":"A flaw was found in binutils, where GNU GCC is vulnerable to a denial of service caused by a stack consumption in the demangle_const() function in libiberty/rust-demangle.c. The vulnerability exists due to the application not properly controlling the consumption of internal resources. By persuading a victim to open a specially-crafted file, an attacker could cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-10-19","epss":0.00953,"percentile":0.60694}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"977b80adf7a11e3a","cpes":["cpe:2.3:a:redhat:nspr:4.39.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nspr:nspr:4.39.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nspr","purl":"pkg:rpm/redhat/nspr@4.39.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"4.39.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12413","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2020-12413","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"risk":0.26433,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-12413","description":"A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman(DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2020-12413","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413","https://raccoon-attack.com/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12413","description":"The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites."}]},{"artifact":{"id":"e0b426fa6c8675c0","cpes":["cpe:2.3:a:redhat:nss:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss","purl":"pkg:rpm/redhat/nss@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-12413","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"0:3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2020-12413","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"risk":0.26433,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-12413","description":"A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman(DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2020-12413","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413","https://raccoon-attack.com/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12413","description":"The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites."}]},{"artifact":{"id":"cedfdf59667300d5","cpes":["cpe:2.3:a:nss-softokn:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-softokn","purl":"pkg:rpm/redhat/nss-softokn@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12413","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2020-12413","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"risk":0.26433,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-12413","description":"A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman(DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2020-12413","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413","https://raccoon-attack.com/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12413","description":"The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites."}]},{"artifact":{"id":"db32f71e42036297","cpes":["cpe:2.3:a:nss-softokn-freebl:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn-freebl:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn_freebl:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn_freebl:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-softokn-freebl","purl":"pkg:rpm/redhat/nss-softokn-freebl@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12413","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2020-12413","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"risk":0.26433,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-12413","description":"A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman(DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2020-12413","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413","https://raccoon-attack.com/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12413","description":"The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites."}]},{"artifact":{"id":"674de6f8ff3cff43","cpes":["cpe:2.3:a:nss-sysinit:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-sysinit:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_sysinit:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_sysinit:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-sysinit","purl":"pkg:rpm/redhat/nss-sysinit@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12413","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2020-12413","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"risk":0.26433,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-12413","description":"A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman(DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2020-12413","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413","https://raccoon-attack.com/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12413","description":"The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites."}]},{"artifact":{"id":"6ffb1d97f8182741","cpes":["cpe:2.3:a:nss-util:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-util:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_util:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_util:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-util","purl":"pkg:rpm/redhat/nss-util@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12413","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2020-12413","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"risk":0.26433,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-12413","description":"A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman(DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2020-12413","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12413","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12413","date":"2026-10-19","epss":0.00594,"percentile":0.47376}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413","https://raccoon-attack.com/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12413","description":"The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites."}]},{"artifact":{"id":"23e3d9feac1cb13c","cpes":["cpe:2.3:a:libgcc:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=rhel-9.8&upstream=gcc-11.5.0-14.el9.src.rpm","type":"rpm","version":"11.5.0-14.el9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-14.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"gcc","version":"11.5.0-14.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"risk":0.2513699999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22693","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-22693","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-10-19","epss":0.00452,"percentile":0.37907}],"risk":0.23278000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-22693","description":"A null pointer dereference vector has been discovered in the harfbuzz package. A null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh:1672-1673. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault."},"relatedVulnerabilities":[{"id":"CVE-2026-22693","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-10-19","epss":0.00452,"percentile":0.37907}],"urls":["https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae","https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww","http://www.openwall.com/lists/oss-security/2026/01/11/1","http://www.openwall.com/lists/oss-security/2026/01/12/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22693","description":"HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0."}]},{"artifact":{"id":"23e3d9feac1cb13c","cpes":["cpe:2.3:a:libgcc:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=rhel-9.8&upstream=gcc-11.5.0-14.el9.src.rpm","type":"rpm","version":"11.5.0-14.el9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-14.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"gcc","version":"11.5.0-14.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-19","epss":0.00363,"percentile":0.28709}],"risk":0.230505,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-19","epss":0.00363,"percentile":0.28709}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40930","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-40930","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40930","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-40930","date":"2026-10-19","epss":0.00355,"percentile":0.27782}],"risk":0.18460000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-40930","description":"A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. In version 1.8.0, a remote attacker could provide a specially crafted APNG (Animated Portable Network Graphics) file. This flaw allows attacker-controlled data within an ignored chunk to be reinterpreted as a new chunk header, leading to a low impact on data integrity and availability. This could result in unexpected application behavior or a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-40930","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40930","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-40930","date":"2026-10-19","epss":0.00355,"percentile":0.27782}],"urls":["https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4","https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x","http://www.openwall.com/lists/oss-security/2026/05/15/21"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40930","description":"LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue."}]},{"artifact":{"id":"baf575c07f8838ff","cpes":["cpe:2.3:a:redhat:glibc:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"0:2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"ab5b6ff68a8c017f","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"8c53b0651858ec57","cpes":["cpe:2.3:a:glibc-langpack-en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack-en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-langpack-en","purl":"pkg:rpm/redhat/glibc-langpack-en@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"23e3d9feac1cb13c","cpes":["cpe:2.3:a:libgcc:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:11.5.0-14.el9:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=rhel-9.8&upstream=gcc-11.5.0-14.el9.src.rpm","type":"rpm","version":"11.5.0-14.el9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-14.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"gcc","version":"11.5.0-14.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"risk":0.15,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.8&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-0232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0232","date":"2026-10-19","epss":0.00381,"percentile":0.30604}],"risk":0.146685,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-0232","description":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-0232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0232","date":"2026-10-19","epss":0.00381,"percentile":0.30604}],"urls":["https://access.redhat.com/security/cve/CVE-2024-0232","https://bugzilla.redhat.com/show_bug.cgi?id=2243754","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/","https://security.netapp.com/advisory/ntap-20240315-0007/","https://cert-portal.siemens.com/productcert/html/ssa-000297.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0232","description":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service."}]},{"artifact":{"id":"977b80adf7a11e3a","cpes":["cpe:2.3:a:redhat:nspr:4.39.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nspr:nspr:4.39.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nspr","purl":"pkg:rpm/redhat/nspr@4.39.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"4.39.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7531","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7531","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"risk":0.133285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7531","description":"The Mozilla Foundation Security Advisory describes this flaw as:\nCalling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on Intel Sandy Bridge and later processors. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change."},"relatedVulnerabilities":[{"id":"CVE-2024-7531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1905691","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7531","description":"Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"e0b426fa6c8675c0","cpes":["cpe:2.3:a:redhat:nss:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss","purl":"pkg:rpm/redhat/nss@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7531","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"0:3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7531","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"risk":0.133285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7531","description":"The Mozilla Foundation Security Advisory describes this flaw as:\nCalling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on Intel Sandy Bridge and later processors. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change."},"relatedVulnerabilities":[{"id":"CVE-2024-7531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1905691","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7531","description":"Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"cedfdf59667300d5","cpes":["cpe:2.3:a:nss-softokn:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_softokn:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-softokn","purl":"pkg:rpm/redhat/nss-softokn@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7531","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7531","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"risk":0.133285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7531","description":"The Mozilla Foundation Security Advisory describes this flaw as:\nCalling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on Intel Sandy Bridge and later processors. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change."},"relatedVulnerabilities":[{"id":"CVE-2024-7531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1905691","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7531","description":"Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"db32f71e42036297","cpes":["cpe:2.3:a:nss-softokn-freebl:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn-freebl:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn_freebl:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn_freebl:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-softokn:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_softokn:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-softokn-freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_softokn_freebl:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-softokn-freebl","purl":"pkg:rpm/redhat/nss-softokn-freebl@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7531","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7531","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"risk":0.133285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7531","description":"The Mozilla Foundation Security Advisory describes this flaw as:\nCalling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on Intel Sandy Bridge and later processors. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change."},"relatedVulnerabilities":[{"id":"CVE-2024-7531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1905691","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7531","description":"Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"674de6f8ff3cff43","cpes":["cpe:2.3:a:nss-sysinit:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-sysinit:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_sysinit:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_sysinit:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_sysinit:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-sysinit","purl":"pkg:rpm/redhat/nss-sysinit@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7531","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7531","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"risk":0.133285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7531","description":"The Mozilla Foundation Security Advisory describes this flaw as:\nCalling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on Intel Sandy Bridge and later processors. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change."},"relatedVulnerabilities":[{"id":"CVE-2024-7531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1905691","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7531","description":"Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"6ffb1d97f8182741","cpes":["cpe:2.3:a:nss-util:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss-util:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_util:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss_util:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss-util:3.124.0-5.el9_6:*:*:*:*:*:*:*","cpe:2.3:a:nss:nss_util:3.124.0-5.el9_6:*:*:*:*:*:*:*"],"name":"nss-util","purl":"pkg:rpm/redhat/nss-util@3.124.0-5.el9_6?arch=x86_64&distro=rhel-9.8&upstream=nss-3.124.0-5.el9_6.src.rpm","type":"rpm","version":"3.124.0-5.el9_6","language":"","licenses":["MPLv2.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nss","version":"3.124.0-5.el9_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7531","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"nss","version":"3.124.0-5.el9_6"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7531","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"risk":0.133285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7531","description":"The Mozilla Foundation Security Advisory describes this flaw as:\nCalling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on Intel Sandy Bridge and later processors. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change."},"relatedVulnerabilities":[{"id":"CVE-2024-7531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-10-19","epss":0.00437,"percentile":0.36641}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1905691","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7531","description":"Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"baf575c07f8838ff","cpes":["cpe:2.3:a:redhat:glibc:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"0:2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89092","description":"A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for the system. There is also a remote possibility of nscd cache corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"ab5b6ff68a8c017f","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89092","description":"A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for the system. There is also a remote possibility of nscd cache corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"8c53b0651858ec57","cpes":["cpe:2.3:a:glibc-langpack-en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack-en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-langpack-en","purl":"pkg:rpm/redhat/glibc-langpack-en@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89092","description":"A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for the system. There is also a remote possibility of nscd cache corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.8&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-70873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-70873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-10-19","epss":0.00332,"percentile":0.24967}],"risk":0.10457999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-70873","description":"A flaw was found in SQLite. This information disclosure vulnerability exists within the zipfile extension, specifically in the zipfileInflate function. A remote attacker could exploit this by providing a specially crafted ZIP file. Successful exploitation could lead to the disclosure of sensitive heap memory information."},"relatedVulnerabilities":[{"id":"CVE-2025-70873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-10-19","epss":0.00332,"percentile":0.24967}],"urls":["https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054","https://sqlite.org/forum/forumpost/761eac3c82","https://sqlite.org/src/info/3d459f1fb1bd1b5e","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file."}]},{"artifact":{"id":"baf575c07f8838ff","cpes":["cpe:2.3:a:redhat:glibc:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"0:2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"ab5b6ff68a8c017f","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"8c53b0651858ec57","cpes":["cpe:2.3:a:glibc-langpack-en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack-en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-langpack-en","purl":"pkg:rpm/redhat/glibc-langpack-en@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"152f717dbbb7ecf4","cpes":["cpe:2.3:a:coreutils-single:coreutils-single:8.32-41.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-single:coreutils_single:8.32-41.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_single:coreutils-single:8.32-41.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_single:coreutils_single:8.32-41.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-single:8.32-41.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_single:8.32-41.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:coreutils-single:8.32-41.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:coreutils_single:8.32-41.el9_8.1:*:*:*:*:*:*:*"],"name":"coreutils-single","purl":"pkg:rpm/redhat/coreutils-single@8.32-41.el9_8.1?arch=x86_64&distro=rhel-9.8&upstream=coreutils-8.32-41.el9_8.1.src.rpm","type":"rpm","version":"8.32-41.el9_8.1","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils","version":"8.32-41.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56391","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"coreutils","version":"8.32-41.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-19","epss":0.00171,"percentile":0.0607}],"risk":0.09490499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56391","description":"A flaw was found in GNU coreutils uniq. When processing specially crafted multibyte input with the --check-chars option, an attacker can trigger an out-of-bounds read. This vulnerability can lead to a denial of service (DoS) due to an application crash and potentially expose sensitive information from adjacent memory."},"relatedVulnerabilities":[{"id":"CVE-2026-56391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-19","epss":0.00171,"percentile":0.0607}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95512","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95512","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95512","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95512","date":"2026-10-19","epss":0.00174,"percentile":0.06468}],"risk":0.09135,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95512","description":"A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-95512","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95512","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95512","date":"2026-10-19","epss":0.00174,"percentile":0.06468}],"urls":["https://access.redhat.com/errata/RHSA-2026:74952","https://access.redhat.com/security/cve/CVE-2026-95512","https://bugzilla.redhat.com/show_bug.cgi?id=2462295","https://gitlab.freedesktop.org/freetype/freetype/-/commit/f3ca71c9900fe860849b3163a6e2c1e765b291d9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95512","description":"A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-64505","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-64505","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64505","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64505","date":"2026-10-19","epss":0.00192,"percentile":0.08301}],"risk":0.09024,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-64505","description":"A heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access."},"relatedVulnerabilities":[{"id":"CVE-2025-64505","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64505","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64505","date":"2026-10-19","epss":0.00192,"percentile":0.08301}],"urls":["https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37","https://github.com/pnggroup/libpng/pull/748","https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64505","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.8&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50812","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-50812","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-19","epss":0.0016,"percentile":0.04742}],"risk":0.084,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-50812","description":"A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-50812","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-19","epss":0.0016,"percentile":0.04742}],"urls":["https://gist.github.com/junius-sec/bb556f333957c5226dede314db0e9e91","https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb1383549f2a18aa35508385d","https://sqlite.org/src/info/e807d4e3798efd53"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50812","description":"A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-28164","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-28164","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-28164","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-28164","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-28164","date":"2026-10-19","epss":0.00162,"percentile":0.05049}],"risk":0.08099999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-28164","description":"A flaw was found in libpng. This buffer overflow vulnerability allows a local attacker to cause a denial of service (DoS) by exploiting the `png_create_read_struct()` function. This can lead to the affected system becoming unresponsive or crashing."},"relatedVulnerabilities":[{"id":"CVE-2025-28164","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-28164","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-28164","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-28164","date":"2026-10-19","epss":0.00162,"percentile":0.05049}],"urls":["https://gist.github.com/kittener/506516f8c22178005b4379c8b2a7de20","https://github.com/pnggroup/libpng/issues/655"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-28164","description":"Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-64506","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-64506","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64506","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64506","date":"2026-10-19","epss":0.0014,"percentile":0.02993}],"risk":0.07769999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-64506","description":"A buffer over read flaw has been discovered in libpng. A heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries."},"relatedVulnerabilities":[{"id":"CVE-2025-64506","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64506","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64506","date":"2026-10-19","epss":0.0014,"percentile":0.02993}],"urls":["https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821","https://github.com/pnggroup/libpng/pull/749","https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64506","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51."}]},{"artifact":{"id":"58e822e367013732","cpes":["cpe:2.3:a:redhat:sed:4.8-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:sed:sed:4.8-10.el9:*:*:*:*:*:*:*"],"name":"sed","purl":"pkg:rpm/redhat/sed@4.8-10.el9?arch=x86_64&distro=rhel-9.8&upstream=sed-4.8-10.el9.src.rpm","type":"rpm","version":"4.8-10.el9","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5958","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"sed","version":"0:4.8-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-5958","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-10-19","epss":0.00137,"percentile":0.02813}],"risk":0.07740499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5958","description":"A Time-of-Check Time-of-Use (TOCTOU) race condition was found in GNU sed. When the -i (in-place) and --follow-symlinks options are used together, sed resolves the symlink but reopens the path for writing. An attacker with write access to the directory containing the symlink can swap it between the check and the open operations. If a privileged user executes sed in this manner on a path influenced by the attacker, it can lead to arbitrary file overwrites and potential privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-5958","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-10-19","epss":0.00137,"percentile":0.02813}],"urls":["https://cert.pl/en/posts/2026/04/CVE-2026-5958","https://www.gnu.org/software/sed/","http://www.openwall.com/lists/oss-security/2026/05/13/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5958","description":"When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores the resolved path for determining when output is written,\n2. opens the original symlink path (not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10."}]},{"artifact":{"id":"baf575c07f8838ff","cpes":["cpe:2.3:a:redhat:glibc:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"0:2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"ab5b6ff68a8c017f","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"8c53b0651858ec57","cpes":["cpe:2.3:a:glibc-langpack-en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack-en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-langpack-en","purl":"pkg:rpm/redhat/glibc-langpack-en@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34757","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-34757","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34757","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34757","date":"2026-10-19","epss":0.00163,"percentile":0.05191}],"risk":0.07661,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34757","description":"A flaw was found in libpng, a library used for handling PNG (Portable Network Graphics) image files. This vulnerability arises when an application reuses a pointer, previously obtained from functions like png_get_PLTE, by passing it back to a corresponding setter function within the same image structure. This action causes the setter to access memory that has already been deallocated, leading to a use-after-free condition. A local attacker could potentially exploit this flaw to corrupt image metadata or disclose sensitive information from the application's memory."},"relatedVulnerabilities":[{"id":"CVE-2026-34757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34757","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34757","date":"2026-10-19","epss":0.00163,"percentile":0.05191}],"urls":["https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a","https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc","https://github.com/pnggroup/libpng/issues/836","https://github.com/pnggroup/libpng/issues/837","https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645","https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34757","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27171","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27171","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-19","epss":0.00209,"percentile":0.10494}],"risk":0.06583499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27171","description":"A flaw was found in zlib. An attacker providing specially crafted input to the `crc32_combine64` or `crc32_combine_gen64` functions could trigger an infinite loop within the `x2nmodp` function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-27171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-19","epss":0.00209,"percentile":0.10494}],"urls":["https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/","https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf","https://github.com/madler/zlib/issues/904","https://github.com/madler/zlib/releases/tag/v1.3.2","https://ostif.org/zlib-audit-complete/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."}]},{"artifact":{"id":"3b95a370d9cbeb72","cpes":["cpe:2.3:a:redhat:zlib:1.2.11-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:zlib:zlib:1.2.11-40.el9:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=rhel-9.8&upstream=zlib-1.2.11-40.el9.src.rpm","type":"rpm","version":"1.2.11-40.el9","language":"","licenses":["zlib and Boost"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-27171","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"zlib","version":"0:1.2.11-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27171","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-19","epss":0.00209,"percentile":0.10494}],"risk":0.06583499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27171","description":"A flaw was found in zlib. An attacker providing specially crafted input to the `crc32_combine64` or `crc32_combine_gen64` functions could trigger an infinite loop within the `x2nmodp` function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-27171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-19","epss":0.00209,"percentile":0.10494}],"urls":["https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/","https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf","https://github.com/madler/zlib/issues/904","https://github.com/madler/zlib/releases/tag/v1.3.2","https://ostif.org/zlib-audit-complete/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."}]},{"artifact":{"id":"baf575c07f8838ff","cpes":["cpe:2.3:a:redhat:glibc:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"0:2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.0582,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"ab5b6ff68a8c017f","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.0582,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"8c53b0651858ec57","cpes":["cpe:2.3:a:glibc-langpack-en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack-en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack_en:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc-langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc_langpack:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-langpack-en:2.34-283.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_langpack_en:2.34-283.el9_8:*:*:*:*:*:*:*"],"name":"glibc-langpack-en","purl":"pkg:rpm/redhat/glibc-langpack-en@2.34-283.el9_8?arch=x86_64&distro=rhel-9.8&upstream=glibc-2.34-283.el9_8.src.rpm","type":"rpm","version":"2.34-283.el9_8","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-283.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"glibc","version":"2.34-283.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.0582,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49919","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-49919","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49919","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-49919","date":"2026-10-19","epss":0.00099,"percentile":0.00781}],"risk":0.05346,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-49919","description":"A flaw was found in FreeType. An attacker could cause an application crash leading to a Denial of Service (DoS) by tricking a user or application into rendering a specially crafted color font. This issue occurs due to an integer overflow during bitmap dimension calculations when blending color font layers, resulting in an undersized memory allocation. FreeType subsequently performs an out-of-bounds write to heap memory, corrupting process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-49919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49919","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-49919","date":"2026-10-19","epss":0.00099,"percentile":0.00781}],"urls":["https://source.android.com/docs/security/bulletin/2026/2026-09-01"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49919","description":"In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}]},{"artifact":{"id":"1b0d0fd6e97f677d","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el9:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el9?arch=x86_64&distro=rhel-9.8&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el9.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el9","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:b4c3b402aa65786c1886780cb82a4278660e80be5be5ca5ae2651c0a51ea8532","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46675","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.8"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-46675","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-46675","description":"A flaw was found in libpng. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) by supplying a specially crafted PNG image. Incomplete decompression of certain metadata chunks can leave a dangling pointer in the library's internal decompression state. When an application finishes processing without reading the image rows, libpng attempts to read from this invalid memory location, resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2026-46675","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"A","score":"100.00","as_of":"2026-10-21T07:47:03.750Z","grype_db_version":"2026-10-20T06:29:49.000Z"}