{"grype_matches":[{"artifact":{"id":"f5c9c48788c56be5","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:curl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:curl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/amzn/curl-minimal@8.21.0-5.amzn2023.0.3?arch=x86_64&distro=amzn-2023&upstream=curl-8.21.0-5.amzn2023.0.3.src.rpm","type":"rpm","version":"8.21.0-5.amzn2023.0.3","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.21.0-5.amzn2023.0.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3404","versionConstraint":"< 8.21.0-5.amzn2023.0.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl-minimal","version":"0:8.21.0-5.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3404","versionConstraint":"< 8.21.0-5.amzn2023.0.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl","version":"8.21.0-5.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3404","fix":{"state":"fixed","versions":["8.21.0-5.amzn2023.0.4"],"available":[{"date":"2026-11-09","kind":"advisory","version":"8.21.0-5.amzn2023.0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411},{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3404.html","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection. (CVE-2026-19931)"},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."},{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"72cc2ac1af00a944","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:libcurl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:libcurl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.21.0-5.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/amzn/libcurl-minimal@8.21.0-5.amzn2023.0.3?arch=x86_64&distro=amzn-2023&upstream=curl-8.21.0-5.amzn2023.0.3.src.rpm","type":"rpm","version":"8.21.0-5.amzn2023.0.3","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.21.0-5.amzn2023.0.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3404","versionConstraint":"< 8.21.0-5.amzn2023.0.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"libcurl-minimal","version":"0:8.21.0-5.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3404","versionConstraint":"< 8.21.0-5.amzn2023.0.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl","version":"8.21.0-5.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3404","fix":{"state":"fixed","versions":["8.21.0-5.amzn2023.0.4"],"available":[{"date":"2026-11-09","kind":"advisory","version":"8.21.0-5.amzn2023.0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411},{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3404.html","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection. (CVE-2026-19931)"},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."},{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"b9252e309c9ee602","cpes":["cpe:2.3:a:amazonlinux:sqlite-libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:sqlite_libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite-libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.40.0-1.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/amzn/sqlite-libs@3.40.0-1.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=sqlite-3.40.0-1.amzn2023.0.8.src.rpm","type":"rpm","version":"3.40.0-1.amzn2023.0.8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.40.0-1.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.40.0-1.amzn2023.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3452","versionConstraint":"< 3.40.0-1.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"sqlite-libs","version":"0:3.40.0-1.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"3.40.0-1.amzn2023.0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3452","versionConstraint":"< 3.40.0-1.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"sqlite","version":"3.40.0-1.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3452","fix":{"state":"fixed","versions":["3.40.0-1.amzn2023.0.9"],"available":[{"date":"2026-11-12","kind":"advisory","version":"3.40.0-1.amzn2023.0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871},{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011},{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485},{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266},{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943},{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546},{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"risk":0.0955,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3452.html","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process. (CVE-2026-119371)SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process. (CVE-2026-119372)SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process. (CVE-2026-119373)SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers. (CVE-2026-119375)SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process. (CVE-2026-119376)SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions. (CVE-2026-119377)SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits. (CVE-2026-119378)"},"relatedVulnerabilities":[{"id":"CVE-2026-119371","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."},{"id":"CVE-2026-119372","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."},{"id":"CVE-2026-119373","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."},{"id":"CVE-2026-119375","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."},{"id":"CVE-2026-119376","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."},{"id":"CVE-2026-119377","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."},{"id":"CVE-2026-119378","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."}]},{"artifact":{"id":"7d3618a5e227b131","cpes":["cpe:2.3:a:amazonlinux:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/amzn/python3-rpm@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"python3-rpm","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3398","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.9"],"available":[{"date":"2026-11-09","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693},{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3398.html","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of attacker-chosen length -- past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. (CVE-2026-103242)A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment. (CVE-2026-84837)A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. (CVE-2026-95519)"},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"79679d56ec0cd8ff","cpes":["cpe:2.3:a:amazonlinux:rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/amzn/rpm@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3398","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.9"],"available":[{"date":"2026-11-09","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693},{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3398.html","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of attacker-chosen length -- past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. (CVE-2026-103242)A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment. (CVE-2026-84837)A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. (CVE-2026-95519)"},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"5efcc28f5e138cb7","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/amzn/rpm-build-libs@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-build-libs","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3398","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.9"],"available":[{"date":"2026-11-09","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693},{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3398.html","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of attacker-chosen length -- past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. (CVE-2026-103242)A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment. (CVE-2026-84837)A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. (CVE-2026-95519)"},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"25c63cabb033ebbe","cpes":["cpe:2.3:a:amazonlinux:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/amzn/rpm-libs@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-libs","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3398","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.9"],"available":[{"date":"2026-11-09","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693},{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3398.html","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of attacker-chosen length -- past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. (CVE-2026-103242)A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment. (CVE-2026-84837)A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. (CVE-2026-95519)"},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"d7c410b07892e24d","cpes":["cpe:2.3:a:rpm-plugin-selinux:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-plugin-selinux:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin_selinux:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin_selinux:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-plugin:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-plugin:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-plugin-selinux","purl":"pkg:rpm/amzn/rpm-plugin-selinux@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-plugin-selinux","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3398","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.9"],"available":[{"date":"2026-11-09","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693},{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3398.html","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of attacker-chosen length -- past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. (CVE-2026-103242)A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment. (CVE-2026-84837)A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. (CVE-2026-95519)"},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"fd28bf62d4f3f5ac","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/amzn/rpm-sign-libs@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-sign-libs","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3398","versionConstraint":"< 4.16.1.3-29.amzn2023.0.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3398","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.9"],"available":[{"date":"2026-11-09","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693},{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3398.html","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of attacker-chosen length -- past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. (CVE-2026-103242)A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment. (CVE-2026-84837)A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. (CVE-2026-95519)"},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"7d3618a5e227b131","cpes":["cpe:2.3:a:amazonlinux:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/amzn/python3-rpm@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"python3-rpm","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3430","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.10"],"available":[{"date":"2026-11-12","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3430.html","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package. (CVE-2026-95520)A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. (CVE-2026-95521)"},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"79679d56ec0cd8ff","cpes":["cpe:2.3:a:amazonlinux:rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/amzn/rpm@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3430","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.10"],"available":[{"date":"2026-11-12","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3430.html","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package. (CVE-2026-95520)A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. (CVE-2026-95521)"},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"5efcc28f5e138cb7","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/amzn/rpm-build-libs@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-build-libs","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3430","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.10"],"available":[{"date":"2026-11-12","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3430.html","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package. (CVE-2026-95520)A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. (CVE-2026-95521)"},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"25c63cabb033ebbe","cpes":["cpe:2.3:a:amazonlinux:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/amzn/rpm-libs@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-libs","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3430","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.10"],"available":[{"date":"2026-11-12","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3430.html","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package. (CVE-2026-95520)A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. (CVE-2026-95521)"},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"d7c410b07892e24d","cpes":["cpe:2.3:a:rpm-plugin-selinux:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-plugin-selinux:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin_selinux:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin_selinux:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-plugin:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-plugin:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_plugin:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-plugin-selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_plugin_selinux:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-plugin-selinux","purl":"pkg:rpm/amzn/rpm-plugin-selinux@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-plugin-selinux","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3430","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.10"],"available":[{"date":"2026-11-12","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3430.html","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package. (CVE-2026-95520)A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. (CVE-2026-95521)"},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"fd28bf62d4f3f5ac","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.16.1.3-29.amzn2023.0.8:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/amzn/rpm-sign-libs@4.16.1.3-29.amzn2023.0.8?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.8.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.8","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-sign-libs","version":"0:4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3430","versionConstraint":"< 4.16.1.3-29.amzn2023.0.10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.8"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3430","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.10"],"available":[{"date":"2026-11-12","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808},{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.08925000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3430.html","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package. (CVE-2026-95520)A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. (CVE-2026-95521)"},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"5f1493b5f0b24c4a","cpes":["cpe:2.3:a:device-mapper:device-mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device-mapper:device_mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device_mapper:device-mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device_mapper:device_mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:device-mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:device_mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device:device-mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device:device_mapper:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*"],"name":"device-mapper","purl":"pkg:rpm/amzn/device-mapper@1.02.185-1.amzn2023.0.5?arch=x86_64&distro=amzn-2023&upstream=lvm2-2.03.16-1.amzn2023.0.5.src.rpm","type":"rpm","version":"1.02.185-1.amzn2023.0.5","language":"","licenses":["GPLv2"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"lvm2","version":"2.03.16-1.amzn2023.0.5"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.02.185-1.amzn2023.0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3376","versionConstraint":"< 1.02.185-1.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"device-mapper","version":"0:1.02.185-1.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"1.02.185-1.amzn2023.0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3376","versionConstraint":"< 2.03.16-1.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"lvm2","version":"2.03.16-1.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3376","fix":{"state":"fixed","versions":["1.02.185-1.amzn2023.0.6","2.03.16-1.amzn2023.0.6"],"available":[{"date":"2026-11-09","kind":"advisory","version":"1.02.185-1.amzn2023.0.6"},{"date":"2026-11-09","kind":"advisory","version":"2.03.16-1.amzn2023.0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19617","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-19617","date":"2026-11-12","epss":0.00158,"percentile":0.05017}],"risk":0.079,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3376.html","description":"A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems. (CVE-2026-19617)"},"relatedVulnerabilities":[{"id":"CVE-2026-19617","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19617","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-19617","date":"2026-11-12","epss":0.00158,"percentile":0.05017}],"urls":["https://access.redhat.com/errata/RHSA-2026:73989","https://access.redhat.com/security/cve/CVE-2026-19617","https://bugzilla.redhat.com/show_bug.cgi?id=2514626"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19617","description":"A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems."}]},{"artifact":{"id":"660ad9c873cca28e","cpes":["cpe:2.3:a:device-mapper-libs:device-mapper-libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device-mapper-libs:device_mapper_libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device_mapper_libs:device-mapper-libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device_mapper_libs:device_mapper_libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device-mapper:device-mapper-libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device-mapper:device_mapper_libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device_mapper:device-mapper-libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device_mapper:device_mapper_libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:device-mapper-libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:device_mapper_libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device:device-mapper-libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:device:device_mapper_libs:1.02.185-1.amzn2023.0.5:*:*:*:*:*:*:*"],"name":"device-mapper-libs","purl":"pkg:rpm/amzn/device-mapper-libs@1.02.185-1.amzn2023.0.5?arch=x86_64&distro=amzn-2023&upstream=lvm2-2.03.16-1.amzn2023.0.5.src.rpm","type":"rpm","version":"1.02.185-1.amzn2023.0.5","language":"","licenses":["LGPLv2"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"lvm2","version":"2.03.16-1.amzn2023.0.5"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.02.185-1.amzn2023.0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3376","versionConstraint":"< 1.02.185-1.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"device-mapper-libs","version":"0:1.02.185-1.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"1.02.185-1.amzn2023.0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3376","versionConstraint":"< 2.03.16-1.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"lvm2","version":"2.03.16-1.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3376","fix":{"state":"fixed","versions":["1.02.185-1.amzn2023.0.6","2.03.16-1.amzn2023.0.6"],"available":[{"date":"2026-11-09","kind":"advisory","version":"1.02.185-1.amzn2023.0.6"},{"date":"2026-11-09","kind":"advisory","version":"2.03.16-1.amzn2023.0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19617","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-19617","date":"2026-11-12","epss":0.00158,"percentile":0.05017}],"risk":0.079,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3376.html","description":"A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems. (CVE-2026-19617)"},"relatedVulnerabilities":[{"id":"CVE-2026-19617","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19617","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-19617","date":"2026-11-12","epss":0.00158,"percentile":0.05017}],"urls":["https://access.redhat.com/errata/RHSA-2026:73989","https://access.redhat.com/security/cve/CVE-2026-19617","https://bugzilla.redhat.com/show_bug.cgi?id=2514626"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19617","description":"A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems."}]},{"artifact":{"id":"331a985deadd9976","cpes":["cpe:2.3:a:amazonlinux:glibc:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/amzn/glibc@2.34-231.amzn2023.0.5?arch=x86_64&distro=amzn-2023&upstream=glibc-2.34-231.amzn2023.0.5.src.rpm","type":"rpm","version":"2.34-231.amzn2023.0.5","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.34-231.amzn2023.0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3396","versionConstraint":"< 2.34-231.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"glibc","version":"0:2.34-231.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3396","fix":{"state":"fixed","versions":["2.34-231.amzn2023.0.6"],"available":[{"date":"2026-11-09","kind":"advisory","version":"2.34-231.amzn2023.0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"risk":0.07275000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3396.html","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability. (CVE-2026-86805)"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"b7e3cb24f73b660e","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:glibc-common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:glibc_common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/amzn/glibc-common@2.34-231.amzn2023.0.5?arch=x86_64&distro=amzn-2023&upstream=glibc-2.34-231.amzn2023.0.5.src.rpm","type":"rpm","version":"2.34-231.amzn2023.0.5","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-231.amzn2023.0.5"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.34-231.amzn2023.0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3396","versionConstraint":"< 2.34-231.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"glibc-common","version":"0:2.34-231.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"2.34-231.amzn2023.0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3396","versionConstraint":"< 2.34-231.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"glibc","version":"2.34-231.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3396","fix":{"state":"fixed","versions":["2.34-231.amzn2023.0.6"],"available":[{"date":"2026-11-09","kind":"advisory","version":"2.34-231.amzn2023.0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"risk":0.07275000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3396.html","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability. (CVE-2026-86805)"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"c9101729e108f7b1","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:glibc-minimal-langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:glibc_minimal_langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.34-231.amzn2023.0.5:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/amzn/glibc-minimal-langpack@2.34-231.amzn2023.0.5?arch=x86_64&distro=amzn-2023&upstream=glibc-2.34-231.amzn2023.0.5.src.rpm","type":"rpm","version":"2.34-231.amzn2023.0.5","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:9092f55e2de89239dab130d9d935f8eaa0e629b08c4c18d401420e57253a9ca5","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-231.amzn2023.0.5"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.34-231.amzn2023.0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3396","versionConstraint":"< 2.34-231.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"glibc-minimal-langpack","version":"0:2.34-231.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"2.34-231.amzn2023.0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3396","versionConstraint":"< 2.34-231.amzn2023.0.6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"glibc","version":"2.34-231.amzn2023.0.5"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3396","fix":{"state":"fixed","versions":["2.34-231.amzn2023.0.6"],"available":[{"date":"2026-11-09","kind":"advisory","version":"2.34-231.amzn2023.0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"risk":0.07275000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3396.html","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability. (CVE-2026-86805)"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]}],"grade":"F","score":"0.00","as_of":"2026-11-13T11:21:23.990Z","grype_db_version":"2026-11-13T06:20:21.000Z"}