{"grype_matches":[{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-12","epss":0.20217,"percentile":0.97502}],"risk":8.390055,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-12","epss":0.20217,"percentile":0.97502}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-12","epss":0.20217,"percentile":0.97502}],"risk":8.390055,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-12","epss":0.20217,"percentile":0.97502}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"e988ae274c693810","cpes":["cpe:2.3:a:redhat:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=rhel-9.9&epoch=2&upstream=tar-1.34-13.el9_8.src.rpm","type":"rpm","version":"2:1.34-13.el9_8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2005-2541","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"tar","version":"2:1.34-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2005-2541","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-11-12","epss":0.03992,"percentile":0.90659}],"risk":2.3951999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2005-2541","description":"A flaw was found in tar utility that can allow the root user to extract files with preserved setuid and setgid permissions without any warning. This behavior can lead to the creation of malicious setuid executables owned by root from a crafted tar file, posing significant security risks."},"relatedVulnerabilities":[{"id":"CVE-2005-2541","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-11-12","epss":0.03992,"percentile":0.90659}],"urls":["http://marc.info/?l=bugtraq&m=112327628230258&w=2","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119586","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"risk":1.181925,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119586","description":"A flaw was found in the SQLite command-line interface. This vulnerability allows an attacker to achieve arbitrary command execution by convincing a user to run the recovery command on a specially crafted database. Because the recovery process fails to sanitize embedded shell instructions within the database schema, piping or re-importing the recovered output into the command-line shell executes operating system commands with the privileges of the running user."},"relatedVulnerabilities":[{"id":"CVE-2026-119586","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-12","epss":0.01966,"percentile":0.80661}],"risk":0.8748700000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-12","epss":0.01966,"percentile":0.80661}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-12","epss":0.01966,"percentile":0.80661}],"risk":0.8748700000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-12","epss":0.01966,"percentile":0.80661}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-9232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-11-12","epss":0.02407,"percentile":0.84314}],"risk":0.734135,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9232","description":"A flaw was found in the OpenSSL HTTP client API no_proxy handling. This vulnerability allows an application level denial of service (application crash) via an attacker-controlled IPv6 URL when the no_proxy environment variable is set."},"relatedVulnerabilities":[{"id":"CVE-2025-9232","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-11-12","epss":0.02407,"percentile":0.84314}],"urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-9232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-11-12","epss":0.02407,"percentile":0.84314}],"risk":0.734135,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9232","description":"A flaw was found in the OpenSSL HTTP client API no_proxy handling. This vulnerability allows an application level denial of service (application crash) via an attacker-controlled IPv6 URL when the no_proxy environment variable is set."},"relatedVulnerabilities":[{"id":"CVE-2025-9232","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-11-12","epss":0.02407,"percentile":0.84314}],"urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-9232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-11-12","epss":0.02407,"percentile":0.84314}],"risk":0.734135,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9232","description":"A flaw was found in the OpenSSL HTTP client API no_proxy handling. This vulnerability allows an application level denial of service (application crash) via an attacker-controlled IPv6 URL when the no_proxy environment variable is set."},"relatedVulnerabilities":[{"id":"CVE-2025-9232","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-11-12","epss":0.02407,"percentile":0.84314}],"urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-12","epss":0.01987,"percentile":0.80905}],"risk":0.6855149999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-9681","description":"A vulnerability was found in curl. When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than intended."},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-12","epss":0.01987,"percentile":0.80905}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-12","epss":0.01987,"percentile":0.80905}],"risk":0.6855149999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-9681","description":"A vulnerability was found in curl. When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than intended."},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-12","epss":0.01987,"percentile":0.80905}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.571875,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"b339e2733f09ab11","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.13-18.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=libxml2-2.9.13-18.el9_9.1.src.rpm","type":"rpm","version":"2.9.13-18.el9_9.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libxml2","version":"0:2.9.13-18.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-0990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-11-12","epss":0.00955,"percentile":0.61872}],"risk":0.520475,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."},"relatedVulnerabilities":[{"id":"CVE-2026-0990","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-11-12","epss":0.00955,"percentile":0.61872}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0990","https://bugzilla.redhat.com/show_bug.cgi?id=2429959","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.5194,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"7ea496b1a090c4af","cpes":["cpe:2.3:a:ncurses:ncurses:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses:6.2-12.20210508.el9:*:*:*:*:*:*:*"],"name":"ncurses","purl":"pkg:rpm/redhat/ncurses@6.2-12.20210508.el9?arch=x86_64&distro=rhel-9.9&upstream=ncurses-6.2-12.20210508.el9.src.rpm","type":"rpm","version":"6.2-12.20210508.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"ncurses","version":"0:6.2-12.20210508.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.49257500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-50495","description":"A vulnerability was found in the NCurses package, where a segmentation fault may be triggered through _nc_wrap_entry()."},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"ecae56e691f56928","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.2-12.20210508.el9:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=rhel-9.9&upstream=ncurses-6.2-12.20210508.el9.src.rpm","type":"rpm","version":"6.2-12.20210508.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.2-12.20210508.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"ncurses","version":"6.2-12.20210508.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.49257500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-50495","description":"A vulnerability was found in the NCurses package, where a segmentation fault may be triggered through _nc_wrap_entry()."},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"b0fd3764b473721b","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.2-12.20210508.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.2-12.20210508.el9:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=rhel-9.9&upstream=ncurses-6.2-12.20210508.el9.src.rpm","type":"rpm","version":"6.2-12.20210508.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.2-12.20210508.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"ncurses","version":"6.2-12.20210508.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.49257500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-50495","description":"A vulnerability was found in the NCurses package, where a segmentation fault may be triggered through _nc_wrap_entry()."},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.48719999999999997,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-41996","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-41996","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-12","epss":0.01083,"percentile":0.65657}],"risk":0.481935,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41996","description":"A vulnerability was found in the Diffie-Hellman Ephemeral (DHE) Key Agreement Protocol, where a malicious client can exploit the server's public key validation process. By forcing the server to use DHE and validating the order of public keys, the client can trigger expensive server-side modular exponentiation calculations. This issue results in asymmetric resource consumption, potentially leading to a denial of service (DoS) attack by overwhelming the server with computationally intensive operations."},"relatedVulnerabilities":[{"id":"CVE-2024-41996","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-12","epss":0.01083,"percentile":0.65657}],"urls":["https://dheatattack.gitlab.io/details/","https://dheatattack.gitlab.io/faq/","https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41996","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-41996","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-12","epss":0.01083,"percentile":0.65657}],"risk":0.481935,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41996","description":"A vulnerability was found in the Diffie-Hellman Ephemeral (DHE) Key Agreement Protocol, where a malicious client can exploit the server's public key validation process. By forcing the server to use DHE and validating the order of public keys, the client can trigger expensive server-side modular exponentiation calculations. This issue results in asymmetric resource consumption, potentially leading to a denial of service (DoS) attack by overwhelming the server with computationally intensive operations."},"relatedVulnerabilities":[{"id":"CVE-2024-41996","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-12","epss":0.01083,"percentile":0.65657}],"urls":["https://dheatattack.gitlab.io/details/","https://dheatattack.gitlab.io/faq/","https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41996","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-41996","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-12","epss":0.01083,"percentile":0.65657}],"risk":0.481935,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41996","description":"A vulnerability was found in the Diffie-Hellman Ephemeral (DHE) Key Agreement Protocol, where a malicious client can exploit the server's public key validation process. By forcing the server to use DHE and validating the order of public keys, the client can trigger expensive server-side modular exponentiation calculations. This issue results in asymmetric resource consumption, potentially leading to a denial of service (DoS) attack by overwhelming the server with computationally intensive operations."},"relatedVulnerabilities":[{"id":"CVE-2024-41996","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-12","epss":0.01083,"percentile":0.65657}],"urls":["https://dheatattack.gitlab.io/details/","https://dheatattack.gitlab.io/faq/","https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"6709e32e10ce5a81","cpes":["cpe:2.3:a:redhat:pcre2:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.40-7.el9_8:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.40-7.el9_8?arch=x86_64&distro=rhel-9.9&upstream=pcre2-10.40-7.el9_8.src.rpm","type":"rpm","version":"10.40-7.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"pcre2","version":"0:10.40-7.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-12","epss":0.01121,"percentile":0.66649}],"risk":0.465215,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-41409","description":"A flaw was found in PCRE2, where it is susceptible to an integer overflow vulnerability triggered by a negative repeat value in the pcre2test subject line that causes infinite looping. This flaw allows a remote attacker to pass specially crafted data to the application, initiating an integer overflow and executing a denial of service (DoS) attack."},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-12","epss":0.01121,"percentile":0.66649}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"564863bbdb4b6c77","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.40-7.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.40-7.el9_8:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.40-7.el9_8?arch=noarch&distro=rhel-9.9&upstream=pcre2-10.40-7.el9_8.src.rpm","type":"rpm","version":"10.40-7.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.40-7.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"pcre2","version":"10.40-7.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-12","epss":0.01121,"percentile":0.66649}],"risk":0.465215,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-41409","description":"A flaw was found in PCRE2, where it is susceptible to an integer overflow vulnerability triggered by a negative repeat value in the pcre2test subject line that causes infinite looping. This flaw allows a remote attacker to pass specially crafted data to the application, initiating an integer overflow and executing a denial of service (DoS) attack."},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-12","epss":0.01121,"percentile":0.66649}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"3b95a370d9cbeb72","cpes":["cpe:2.3:a:redhat:zlib:1.2.11-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:zlib:zlib:1.2.11-40.el9:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=rhel-9.9&upstream=zlib-1.2.11-40.el9.src.rpm","type":"rpm","version":"1.2.11-40.el9","language":"","licenses":["zlib and Boost"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76844","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"zlib","version":"0:1.2.11-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-76844","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76844","date":"2026-11-12","epss":0.00592,"percentile":0.488}],"risk":0.46176000000000006,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76844","description":"A flaw was found in zlib. When an underlying write operation fails, the gz_write() function exits without properly resetting an internal stream pointer, leaving it referencing stale memory. A subsequent write call can derive an offset from this stale pointer and write past the boundary of a heap allocation, resulting in a heap-based buffer overflow. An attacker who can trigger write errors during compression operations could exploit this vulnerability to execute arbitrary code or cause an application crash leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-76844","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76844","date":"2026-11-12","epss":0.00592,"percentile":0.488}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76844","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"risk":0.45484,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86409","description":"A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"risk":0.45484,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86409","description":"A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"6b29b8ef2f83cc22","cpes":["cpe:2.3:a:redhat:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:4.16.1.3-43.el9_9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"< 0:4.16.1.3-43.el9_9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"0:4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"fixed","versions":["0:4.16.1.3-43.el9_9"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:4.16.1.3-43.el9_9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"risk":0.44864,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99593","link":"https://access.redhat.com/errata/RHSA-2026:99593"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"108e4bcd5f0cf305","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-40.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:4.16.1.3-43.el9_9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"< 0:4.16.1.3-43.el9_9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"fixed","versions":["0:4.16.1.3-43.el9_9"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:4.16.1.3-43.el9_9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"risk":0.44864,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99593","link":"https://access.redhat.com/errata/RHSA-2026:99593"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-12","epss":0.00701,"percentile":0.53693}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"risk":0.42952499999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19931","description":"A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"risk":0.42952499999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19931","description":"A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-11-12","epss":0.00747,"percentile":0.5536}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"b339e2733f09ab11","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.13-18.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=libxml2-2.9.13-18.el9_9.1.src.rpm","type":"rpm","version":"2.9.13-18.el9_9.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-45322","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libxml2","version":"0:2.9.13-18.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-45322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45322","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45322","date":"2026-11-12","epss":0.00965,"percentile":0.62166}],"risk":0.4294250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-45322","description":"A flaw was found in libxml2. In an out-of-memory condition or when limiting the memory allocation, processing a XML document using the HTML parser may result in a use-after-free vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2023-45322","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45322","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45322","date":"2026-11-12","epss":0.00965,"percentile":0.62166}],"urls":["http://www.openwall.com/lists/oss-security/2023/10/06/5","https://gitlab.gnome.org/GNOME/libxml2/-/issues/344","https://gitlab.gnome.org/GNOME/libxml2/-/issues/583","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45322","description":"libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\""}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.42304,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"risk":0.40895500000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28388","description":"A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"risk":0.40895500000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28388","description":"A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"risk":0.40895500000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28388","description":"A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9546","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9546","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-12","epss":0.00652,"percentile":0.51757}],"risk":0.4075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9546","description":"A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers."},"relatedVulnerabilities":[{"id":"CVE-2026-9546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-12","epss":0.00652,"percentile":0.51757}],"urls":["https://curl.se/docs/CVE-2026-9546.html","https://curl.se/docs/CVE-2026-9546.json","https://hackerone.com/reports/3754343"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","description":"A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9546","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9546","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-12","epss":0.00652,"percentile":0.51757}],"risk":0.4075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9546","description":"A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers."},"relatedVulnerabilities":[{"id":"CVE-2026-9546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-12","epss":0.00652,"percentile":0.51757}],"urls":["https://curl.se/docs/CVE-2026-9546.html","https://curl.se/docs/CVE-2026-9546.json","https://hackerone.com/reports/3754343"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","description":"A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}]},{"artifact":{"id":"fce0e99a7fcacb99","cpes":["cpe:2.3:a:libatomic:libatomic:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libatomic:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libatomic","purl":"pkg:rpm/redhat/libatomic@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-12","epss":0.00953,"percentile":0.6182}],"risk":0.4050250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-27943","description":"A flaw was found in binutils, where GNU GCC is vulnerable to a denial of service caused by a stack consumption in the demangle_const() function in libiberty/rust-demangle.c. The vulnerability exists due to the application not properly controlling the consumption of internal resources. By persuading a victim to open a specially-crafted file, an attacker could cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-12","epss":0.00953,"percentile":0.6182}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"121f94a71faca488","cpes":["cpe:2.3:a:libgcc:libgcc:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-12","epss":0.00953,"percentile":0.6182}],"risk":0.4050250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-27943","description":"A flaw was found in binutils, where GNU GCC is vulnerable to a denial of service caused by a stack consumption in the demangle_const() function in libiberty/rust-demangle.c. The vulnerability exists due to the application not properly controlling the consumption of internal resources. By persuading a victim to open a specially-crafted file, an attacker could cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-12","epss":0.00953,"percentile":0.6182}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"de72198654483c11","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-12","epss":0.00953,"percentile":0.6182}],"risk":0.4050250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-27943","description":"A flaw was found in binutils, where GNU GCC is vulnerable to a denial of service caused by a stack consumption in the demangle_const() function in libiberty/rust-demangle.c. The vulnerability exists due to the application not properly controlling the consumption of internal resources. By persuading a victim to open a specially-crafted file, an attacker could cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-12","epss":0.00953,"percentile":0.6182}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"risk":0.4019249999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92388","description":"A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access."},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"risk":0.4019249999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92388","description":"A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access."},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.39899999999999997,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"risk":0.39060999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92391","description":"A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"risk":0.39060999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92391","description":"A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"4987714346273301","cpes":["cpe:2.3:a:libssh:libssh:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.10.4-19.el9_8:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.10.4-19.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libssh-0.10.4-19.el9_8.src.rpm","type":"rpm","version":"0.10.4-19.el9_8","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3731","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libssh","version":"0:0.10.4-19.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-3731","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-12","epss":0.00724,"percentile":0.54545}],"risk":0.37285999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3731","description":"A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive."},"relatedVulnerabilities":[{"id":"CVE-2026-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-12","epss":0.00724,"percentile":0.54545}],"urls":["https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60","https://vuldb.com/?ctiid.349709","https://vuldb.com/?id.349709","https://vuldb.com/?submit.767120","https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz","https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}]},{"artifact":{"id":"6b32f79bfc4dbf71","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.10.4-19.el9_8?arch=noarch&distro=rhel-9.9&upstream=libssh-0.10.4-19.el9_8.src.rpm","type":"rpm","version":"0.10.4-19.el9_8","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.10.4-19.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3731","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libssh","version":"0.10.4-19.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-3731","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-12","epss":0.00724,"percentile":0.54545}],"risk":0.37285999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3731","description":"A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive."},"relatedVulnerabilities":[{"id":"CVE-2026-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-12","epss":0.00724,"percentile":0.54545}],"urls":["https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60","https://vuldb.com/?ctiid.349709","https://vuldb.com/?id.349709","https://vuldb.com/?submit.767120","https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz","https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}]},{"artifact":{"id":"6b29b8ef2f83cc22","cpes":["cpe:2.3:a:redhat:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"0:4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.37248,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"108e4bcd5f0cf305","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-40.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"risk":0.37248,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-12","epss":0.00582,"percentile":0.48301}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"risk":0.37202,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28389","description":"A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data."},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"risk":0.37202,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28389","description":"A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data."},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"risk":0.37202,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28389","description":"A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data."},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-12","epss":0.00719,"percentile":0.54401}],"risk":0.37028500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-12","epss":0.00719,"percentile":0.54401}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-12","epss":0.00719,"percentile":0.54401}],"risk":0.37028500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-12","epss":0.00719,"percentile":0.54401}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.36928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-32636","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32636","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32636","date":"2026-11-12","epss":0.00791,"percentile":0.5678}],"risk":0.36386,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499."},"relatedVulnerabilities":[{"id":"CVE-2023-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32636","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32636","date":"2026-11-12","epss":0.00791,"percentile":0.5678}],"urls":["https://gitlab.gnome.org/GNOME/glib/-/issues/2841","https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835","https://security.netapp.com/advisory/ntap-20231110-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499."}]},{"artifact":{"id":"32dc8d9385f596a8","cpes":["cpe:2.3:a:json-glib:json-glib:1.6.6-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:json-glib:json_glib:1.6.6-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:json_glib:json-glib:1.6.6-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:json_glib:json_glib:1.6.6-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:json-glib:1.6.6-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:json_glib:1.6.6-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:json:json-glib:1.6.6-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:json:json_glib:1.6.6-1.el9:*:*:*:*:*:*:*"],"name":"json-glib","purl":"pkg:rpm/redhat/json-glib@1.6.6-1.el9?arch=x86_64&distro=rhel-9.9&upstream=json-glib-1.6.6-1.el9.src.rpm","type":"rpm","version":"1.6.6-1.el9","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-120194","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"json-glib","version":"0:1.6.6-1.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-120194","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120194","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120194","date":"2026-11-12","epss":0.00475,"percentile":0.41572}],"risk":0.35624999999999996,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-120194","description":"A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-120194","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120194","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120194","date":"2026-11-12","epss":0.00475,"percentile":0.41572}],"urls":["https://access.redhat.com/security/cve/CVE-2026-120194","https://bugzilla.redhat.com/show_bug.cgi?id=2564418","https://gitlab.gnome.org/GNOME/json-glib/-/issues/96"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120194","description":"A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-12","epss":0.00618,"percentile":0.50138}],"risk":0.35534999999999994,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-12","epss":0.00618,"percentile":0.50138}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-12","epss":0.00618,"percentile":0.50138}],"risk":0.35534999999999994,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-12","epss":0.00618,"percentile":0.50138}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"bb911813b45585f3","cpes":["cpe:2.3:a:perl-AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-AutoLoader","purl":"pkg:rpm/redhat/perl-AutoLoader@5.74-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:5.74-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"7e60fe54e6c09824","cpes":["cpe:2.3:a:perl-B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-B","purl":"pkg:rpm/redhat/perl-B@1.80-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.80-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"006f5e08bfc4c952","cpes":["cpe:2.3:a:perl-Class-Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class-Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Class-Struct","purl":"pkg:rpm/redhat/perl-Class-Struct@0.66-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.66-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"2a9a518a53c7512b","cpes":["cpe:2.3:a:perl-Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Errno","purl":"pkg:rpm/redhat/perl-Errno@1.30-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.30-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"f01ef4b3b3b90538","cpes":["cpe:2.3:a:perl-Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Fcntl","purl":"pkg:rpm/redhat/perl-Fcntl@1.13-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.13-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"965edf03abd14e95","cpes":["cpe:2.3:a:perl-File-Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-Basename","purl":"pkg:rpm/redhat/perl-File-Basename@2.85-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.85-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"7cb125d521892030","cpes":["cpe:2.3:a:perl-File-stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-stat","purl":"pkg:rpm/redhat/perl-File-stat@1.09-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.09-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"67e8889d83c474fb","cpes":["cpe:2.3:a:perl-FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-FileHandle","purl":"pkg:rpm/redhat/perl-FileHandle@2.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"955cb53aefe39959","cpes":["cpe:2.3:a:perl-Getopt-Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt-Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Getopt-Std","purl":"pkg:rpm/redhat/perl-Getopt-Std@1.12-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.12-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"e824797a395c58fc","cpes":["cpe:2.3:a:perl-IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IO","purl":"pkg:rpm/redhat/perl-IO@1.43-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.43-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"42816d98549babcf","cpes":["cpe:2.3:a:perl-IPC-Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC-Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IPC-Open3","purl":"pkg:rpm/redhat/perl-IPC-Open3@1.21-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.21-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"7db8a261840c5baa","cpes":["cpe:2.3:a:perl-NDBM-File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-NDBM_File","purl":"pkg:rpm/redhat/perl-NDBM_File@1.15-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.15-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"4d811d3afb2547c9","cpes":["cpe:2.3:a:perl-POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-POSIX","purl":"pkg:rpm/redhat/perl-POSIX@1.94-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.94-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"1bc88a0c5a9ab30a","cpes":["cpe:2.3:a:perl-SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-SelectSaver","purl":"pkg:rpm/redhat/perl-SelectSaver@1.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"449e2b4e3fa8b962","cpes":["cpe:2.3:a:perl-Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Symbol","purl":"pkg:rpm/redhat/perl-Symbol@1.08-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.08-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"21c1a8a82e4461bf","cpes":["cpe:2.3:a:perl-base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:rpm/redhat/perl-base@2.27-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.27-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"a0ae61863ea1a76d","cpes":["cpe:2.3:a:perl-if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-if","purl":"pkg:rpm/redhat/perl-if@0.60.800-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.60.800-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"4ac7ee895d3c99ec","cpes":["cpe:2.3:a:perl-interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-interpreter","purl":"pkg:rpm/redhat/perl-interpreter@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"bf2c1b6ec909c416","cpes":["cpe:2.3:a:perl-libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-libs","purl":"pkg:rpm/redhat/perl-libs@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["(GPL+ or Artistic) and BSD and HSRL and MIT and UCD and Public domain"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"8deef1192afd481d","cpes":["cpe:2.3:a:perl-mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-mro","purl":"pkg:rpm/redhat/perl-mro@1.23-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.23-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"9b9db6c4ad38ca1b","cpes":["cpe:2.3:a:perl-overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overload","purl":"pkg:rpm/redhat/perl-overload@1.31-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.31-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"e12188ce897a6a75","cpes":["cpe:2.3:a:perl-overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overloading","purl":"pkg:rpm/redhat/perl-overloading@0.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"103e8134631ed773","cpes":["cpe:2.3:a:perl-subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-subs","purl":"pkg:rpm/redhat/perl-subs@1.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"7a082b0e6a9156ba","cpes":["cpe:2.3:a:perl-vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-vars","purl":"pkg:rpm/redhat/perl-vars@1.05-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.05-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.33752499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19487","description":"A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"risk":0.33599999999999997,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-115506","description":"A flaw was found in expat. The parser's protection mechanism against recursive entity expansion detects amplification thresholds too late during document processing. A remote attacker can exploit this vulnerability by supplying a crafted XML document with nested entity definitions, causing excessive CPU consumption and resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"e988ae274c693810","cpes":["cpe:2.3:a:redhat:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=rhel-9.9&epoch=2&upstream=tar-1.34-13.el9_8.src.rpm","type":"rpm","version":"2:1.34-13.el9_8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59871","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"tar","version":"2:1.34-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-59871","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59871","date":"2026-11-12","epss":0.00644,"percentile":0.51377}],"risk":0.33166,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59871","description":"A flaw was found in node-tar, a library for manipulating tar archives in Node.js. This vulnerability occurs when the library incorrectly converts specific archive path values into numbers, leading to an error during subsequent path processing. An attacker could exploit this to cause the application using node-tar to crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-59871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59871","date":"2026-11-12","epss":0.00644,"percentile":0.51377}],"urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18."}]},{"artifact":{"id":"b339e2733f09ab11","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.13-18.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=libxml2-2.9.13-18.el9_9.1.src.rpm","type":"rpm","version":"2.9.13-18.el9_9.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-27113","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libxml2","version":"0:2.9.13-18.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-27113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-11-12","epss":0.01062,"percentile":0.65061}],"risk":0.32391,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-27113","description":"A flaw was found in libxml2. This vulnerability allows a NULL pointer dereference, leading to a potential crash or denial of service via a crafted XML pattern."},"relatedVulnerabilities":[{"id":"CVE-2025-27113","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-11-12","epss":0.01062,"percentile":0.65061}],"urls":["https://gitlab.gnome.org/GNOME/libxml2/-/issues/861","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://security.netapp.com/advisory/ntap-20250306-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27113","description":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-12","epss":0.0068,"percentile":0.52905}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-12","epss":0.0068,"percentile":0.52905}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-12","epss":0.0068,"percentile":0.52905}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-12","epss":0.0068,"percentile":0.52905}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.3211,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86414","description":"A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens."},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.3211,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86414","description":"A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens."},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"f3ae9e80296c3638","cpes":["cpe:2.3:a:perl-Socket:perl-Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl-Socket:perl_Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl_Socket:perl-Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl_Socket:perl_Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Socket:4\\:2.031-4.el9:*:*:*:*:*:*:*"],"name":"perl-Socket","purl":"pkg:rpm/redhat/perl-Socket@2.031-4.el9?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-Socket-2.031-4.el9.src.rpm","type":"rpm","version":"4:2.031-4.el9","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl-Socket","version":"4:2.031-4.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"risk":0.30591,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12087","description":"A flaw was found in the `perl-Socket` component. The `pack_ip_mreq_source()` function, which handles network socket operations, contains an out-of-bounds heap read vulnerability. An attacker providing a specially crafted input can cause the system to read beyond the intended memory buffer, potentially leading to information disclosure from adjacent memory regions."},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-12","epss":0.0055,"percentile":0.46504}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-12","epss":0.0055,"percentile":0.46504}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-12","epss":0.0055,"percentile":0.46504}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-12","epss":0.0055,"percentile":0.46504}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-12","epss":0.00494,"percentile":0.42926}],"risk":0.30380999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9080","description":"A flaw was found in libcurl. When `curl_easy_pause()` is called within the event-based `CURLMOPT_SOCKETFUNCTION` callback, a use-after-free vulnerability is triggered. This occurs because libcurl attempts to store a flag using a pointer to memory that has already been freed. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-12","epss":0.00494,"percentile":0.42926}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-12","epss":0.00494,"percentile":0.42926}],"risk":0.30380999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9080","description":"A flaw was found in libcurl. When `curl_easy_pause()` is called within the event-based `CURLMOPT_SOCKETFUNCTION` callback, a use-after-free vulnerability is triggered. This occurs because libcurl attempts to store a flag using a pointer to memory that has already been freed. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-12","epss":0.00494,"percentile":0.42926}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-12","epss":0.00519,"percentile":0.44621}],"risk":0.298425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-12","epss":0.00519,"percentile":0.44621}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-12","epss":0.00519,"percentile":0.44621}],"risk":0.298425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-12","epss":0.00519,"percentile":0.44621}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-13176","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-12","epss":0.00749,"percentile":0.55414}],"risk":0.28836500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-13176","description":"A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected."},"relatedVulnerabilities":[{"id":"CVE-2024-13176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.6,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-12","epss":0.00749,"percentile":0.55414}],"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-13176","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-12","epss":0.00749,"percentile":0.55414}],"risk":0.28836500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-13176","description":"A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected."},"relatedVulnerabilities":[{"id":"CVE-2024-13176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.6,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-12","epss":0.00749,"percentile":0.55414}],"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-13176","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-12","epss":0.00749,"percentile":0.55414}],"risk":0.28836500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-13176","description":"A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected."},"relatedVulnerabilities":[{"id":"CVE-2024-13176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.6,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-12","epss":0.00749,"percentile":0.55414}],"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"risk":0.279775,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92390","description":"A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system."},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"risk":0.279775,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92390","description":"A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system."},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"risk":0.27737999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87864","description":"A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session."},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"risk":0.27737999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87864","description":"A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session."},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"fce0e99a7fcacb99","cpes":["cpe:2.3:a:libatomic:libatomic:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libatomic:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libatomic","purl":"pkg:rpm/redhat/libatomic@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-11-12","epss":0.00859,"percentile":0.58952}],"risk":0.27058499999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-11-12","epss":0.00859,"percentile":0.58952}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"121f94a71faca488","cpes":["cpe:2.3:a:libgcc:libgcc:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-11-12","epss":0.00859,"percentile":0.58952}],"risk":0.27058499999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-11-12","epss":0.00859,"percentile":0.58952}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"de72198654483c11","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-11-12","epss":0.00859,"percentile":0.58952}],"risk":0.27058499999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-11-12","epss":0.00859,"percentile":0.58952}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"risk":0.26923,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-113351","description":"A flaw was found in expat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a large XML document to an application that reuses parser instances. When the XML parser is reset using XML_ParserReset, it clears the direct byte count but fails to offset tracked heap allocations. Consequently, subsequent parsing operations on the reused parser fail with out-of-memory errors until the parser is completely recreated."},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76641","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-76641","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76641","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76641","date":"2026-11-12","epss":0.00353,"percentile":0.29448}],"risk":0.26475,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76641","description":"A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes."},"relatedVulnerabilities":[{"id":"CVE-2026-76641","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76641","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76641","date":"2026-11-12","epss":0.00353,"percentile":0.29448}],"urls":["https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf","https://github.com/libexpat/libexpat/pull/1331","https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76641","description":"Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107708","description":"A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center (KDC) to cause a Denial of Service (DoS). By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate (PAC), an attacker can trigger a NULL pointer dereference that crashes the KDC daemon, interrupting authentication services."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3784","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-3784","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-12","epss":0.00448,"percentile":0.39441}],"risk":0.2576,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3784","description":"A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user."},"relatedVulnerabilities":[{"id":"CVE-2026-3784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-12","epss":0.00448,"percentile":0.39441}],"urls":["https://curl.se/docs/CVE-2026-3784.html","https://curl.se/docs/CVE-2026-3784.json","https://hackerone.com/reports/3584903","http://www.openwall.com/lists/oss-security/2026/03/11/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","description":"curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3784","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-3784","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-12","epss":0.00448,"percentile":0.39441}],"risk":0.2576,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3784","description":"A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user."},"relatedVulnerabilities":[{"id":"CVE-2026-3784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-12","epss":0.00448,"percentile":0.39441}],"urls":["https://curl.se/docs/CVE-2026-3784.html","https://curl.se/docs/CVE-2026-3784.json","https://hackerone.com/reports/3584903","http://www.openwall.com/lists/oss-security/2026/03/11/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","description":"curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection."}]},{"artifact":{"id":"4987714346273301","cpes":["cpe:2.3:a:libssh:libssh:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.10.4-19.el9_8:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.10.4-19.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libssh-0.10.4-19.el9_8.src.rpm","type":"rpm","version":"0.10.4-19.el9_8","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5372","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libssh","version":"0:0.10.4-19.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-5372","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5372","cwe":"CWE-682","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5372","date":"2026-11-12","epss":0.00513,"percentile":0.44265}],"risk":0.2565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5372","description":"A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2025-5372","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5372","cwe":"CWE-682","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5372","date":"2026-11-12","epss":0.00513,"percentile":0.44265}],"urls":["https://access.redhat.com/errata/RHSA-2025:21977","https://access.redhat.com/errata/RHSA-2025:23024","https://access.redhat.com/errata/RHSA-2026:20610","https://access.redhat.com/errata/RHSA-2026:24349","https://access.redhat.com/errata/RHSA-2026:25911","https://access.redhat.com/security/cve/CVE-2025-5372","https://bugzilla.redhat.com/show_bug.cgi?id=2369388"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5372","description":"A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability."}]},{"artifact":{"id":"6b32f79bfc4dbf71","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.10.4-19.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.10.4-19.el9_8:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.10.4-19.el9_8?arch=noarch&distro=rhel-9.9&upstream=libssh-0.10.4-19.el9_8.src.rpm","type":"rpm","version":"0.10.4-19.el9_8","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.10.4-19.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5372","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libssh","version":"0.10.4-19.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-5372","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5372","cwe":"CWE-682","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5372","date":"2026-11-12","epss":0.00513,"percentile":0.44265}],"risk":0.2565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5372","description":"A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2025-5372","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5372","cwe":"CWE-682","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5372","date":"2026-11-12","epss":0.00513,"percentile":0.44265}],"urls":["https://access.redhat.com/errata/RHSA-2025:21977","https://access.redhat.com/errata/RHSA-2025:23024","https://access.redhat.com/errata/RHSA-2026:20610","https://access.redhat.com/errata/RHSA-2026:24349","https://access.redhat.com/errata/RHSA-2026:25911","https://access.redhat.com/security/cve/CVE-2025-5372","https://bugzilla.redhat.com/show_bug.cgi?id=2369388"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5372","description":"A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-12","epss":0.00408,"percentile":0.35578}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9545","description":"A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's certificate. This could lead to the disclosure of sensitive information to the attacker."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-12","epss":0.00408,"percentile":0.35578}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-12","epss":0.00408,"percentile":0.35578}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9545","description":"A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's certificate. This could lead to the disclosure of sensitive information to the attacker."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-12","epss":0.00408,"percentile":0.35578}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"bb911813b45585f3","cpes":["cpe:2.3:a:perl-AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-AutoLoader","purl":"pkg:rpm/redhat/perl-AutoLoader@5.74-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:5.74-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"7e60fe54e6c09824","cpes":["cpe:2.3:a:perl-B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-B","purl":"pkg:rpm/redhat/perl-B@1.80-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.80-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"006f5e08bfc4c952","cpes":["cpe:2.3:a:perl-Class-Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class-Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Class-Struct","purl":"pkg:rpm/redhat/perl-Class-Struct@0.66-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.66-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"2a9a518a53c7512b","cpes":["cpe:2.3:a:perl-Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Errno","purl":"pkg:rpm/redhat/perl-Errno@1.30-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.30-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"f01ef4b3b3b90538","cpes":["cpe:2.3:a:perl-Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Fcntl","purl":"pkg:rpm/redhat/perl-Fcntl@1.13-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.13-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"965edf03abd14e95","cpes":["cpe:2.3:a:perl-File-Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-Basename","purl":"pkg:rpm/redhat/perl-File-Basename@2.85-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.85-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"7cb125d521892030","cpes":["cpe:2.3:a:perl-File-stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-stat","purl":"pkg:rpm/redhat/perl-File-stat@1.09-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.09-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"67e8889d83c474fb","cpes":["cpe:2.3:a:perl-FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-FileHandle","purl":"pkg:rpm/redhat/perl-FileHandle@2.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"955cb53aefe39959","cpes":["cpe:2.3:a:perl-Getopt-Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt-Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Getopt-Std","purl":"pkg:rpm/redhat/perl-Getopt-Std@1.12-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.12-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"e824797a395c58fc","cpes":["cpe:2.3:a:perl-IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IO","purl":"pkg:rpm/redhat/perl-IO@1.43-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.43-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"42816d98549babcf","cpes":["cpe:2.3:a:perl-IPC-Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC-Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IPC-Open3","purl":"pkg:rpm/redhat/perl-IPC-Open3@1.21-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.21-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"7db8a261840c5baa","cpes":["cpe:2.3:a:perl-NDBM-File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-NDBM_File","purl":"pkg:rpm/redhat/perl-NDBM_File@1.15-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.15-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"4d811d3afb2547c9","cpes":["cpe:2.3:a:perl-POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-POSIX","purl":"pkg:rpm/redhat/perl-POSIX@1.94-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.94-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"1bc88a0c5a9ab30a","cpes":["cpe:2.3:a:perl-SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-SelectSaver","purl":"pkg:rpm/redhat/perl-SelectSaver@1.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"449e2b4e3fa8b962","cpes":["cpe:2.3:a:perl-Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Symbol","purl":"pkg:rpm/redhat/perl-Symbol@1.08-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.08-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"21c1a8a82e4461bf","cpes":["cpe:2.3:a:perl-base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:rpm/redhat/perl-base@2.27-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.27-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"a0ae61863ea1a76d","cpes":["cpe:2.3:a:perl-if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-if","purl":"pkg:rpm/redhat/perl-if@0.60.800-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.60.800-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"4ac7ee895d3c99ec","cpes":["cpe:2.3:a:perl-interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-interpreter","purl":"pkg:rpm/redhat/perl-interpreter@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"bf2c1b6ec909c416","cpes":["cpe:2.3:a:perl-libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-libs","purl":"pkg:rpm/redhat/perl-libs@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["(GPL+ or Artistic) and BSD and HSRL and MIT and UCD and Public domain"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"8deef1192afd481d","cpes":["cpe:2.3:a:perl-mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-mro","purl":"pkg:rpm/redhat/perl-mro@1.23-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.23-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"9b9db6c4ad38ca1b","cpes":["cpe:2.3:a:perl-overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overload","purl":"pkg:rpm/redhat/perl-overload@1.31-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.31-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"e12188ce897a6a75","cpes":["cpe:2.3:a:perl-overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overloading","purl":"pkg:rpm/redhat/perl-overloading@0.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"103e8134631ed773","cpes":["cpe:2.3:a:perl-subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-subs","purl":"pkg:rpm/redhat/perl-subs@1.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"7a082b0e6a9156ba","cpes":["cpe:2.3:a:perl-vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-vars","purl":"pkg:rpm/redhat/perl-vars@1.05-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.05-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6659","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6659","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"risk":0.24808499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6659","description":"A flaw was found in Crypt::PasswdMD5 for Perl. This component generates insecure random values for cryptographic salts, which are used to strengthen password hashes. The built-in `rand` function, used for generating these salts, is predictable and not suitable for cryptographic purposes. This vulnerability could allow an attacker to more easily crack password hashes, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-6659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6659","cwe":"CWE-338","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-6659","date":"2026-11-12","epss":0.00447,"percentile":0.39348}],"urls":["https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch","https://github.com/ronsavage/Crypt-PasswdMD5/pull/3","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47","https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes","http://www.openwall.com/lists/oss-security/2026/05/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","description":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography."}]},{"artifact":{"id":"2c3aa3a74a1e1b84","cpes":["cpe:2.3:a:libpkgconf:libpkgconf:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libpkgconf:1.7.3-10.el9:*:*:*:*:*:*:*"],"name":"libpkgconf","purl":"pkg:rpm/redhat/libpkgconf@1.7.3-10.el9?arch=x86_64&distro=rhel-9.9&upstream=pkgconf-1.7.3-10.el9.src.rpm","type":"rpm","version":"1.7.3-10.el9","language":"","licenses":["ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pkgconf","version":"1.7.3-10.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"pkgconf","version":"1.7.3-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-24056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"risk":0.246925,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-24056","description":"A flaw was found in pkgconf, where a variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. This issue may lead to a buffer overflow, which can crash the software."},"relatedVulnerabilities":[{"id":"CVE-2023-24056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"urls":["https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059","https://github.com/pkgconf/pkgconf/tags","https://nullprogram.com/blog/2023/01/18/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes."}]},{"artifact":{"id":"0464bb215cb340f3","cpes":["cpe:2.3:a:pkgconf:pkgconf:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pkgconf:1.7.3-10.el9:*:*:*:*:*:*:*"],"name":"pkgconf","purl":"pkg:rpm/redhat/pkgconf@1.7.3-10.el9?arch=x86_64&distro=rhel-9.9&upstream=pkgconf-1.7.3-10.el9.src.rpm","type":"rpm","version":"1.7.3-10.el9","language":"","licenses":["ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-24056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"pkgconf","version":"0:1.7.3-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-24056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"risk":0.246925,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-24056","description":"A flaw was found in pkgconf, where a variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. This issue may lead to a buffer overflow, which can crash the software."},"relatedVulnerabilities":[{"id":"CVE-2023-24056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"urls":["https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059","https://github.com/pkgconf/pkgconf/tags","https://nullprogram.com/blog/2023/01/18/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes."}]},{"artifact":{"id":"59c097ef22d4b886","cpes":["cpe:2.3:a:pkgconf-m4:pkgconf-m4:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf-m4:pkgconf_m4:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf_m4:pkgconf-m4:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf_m4:pkgconf_m4:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf:pkgconf-m4:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf:pkgconf_m4:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pkgconf-m4:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pkgconf_m4:1.7.3-10.el9:*:*:*:*:*:*:*"],"name":"pkgconf-m4","purl":"pkg:rpm/redhat/pkgconf-m4@1.7.3-10.el9?arch=noarch&distro=rhel-9.9&upstream=pkgconf-1.7.3-10.el9.src.rpm","type":"rpm","version":"1.7.3-10.el9","language":"","licenses":["GPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pkgconf","version":"1.7.3-10.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"pkgconf","version":"1.7.3-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-24056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"risk":0.246925,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-24056","description":"A flaw was found in pkgconf, where a variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. This issue may lead to a buffer overflow, which can crash the software."},"relatedVulnerabilities":[{"id":"CVE-2023-24056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"urls":["https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059","https://github.com/pkgconf/pkgconf/tags","https://nullprogram.com/blog/2023/01/18/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes."}]},{"artifact":{"id":"edce6e9bd49048cf","cpes":["cpe:2.3:a:pkgconf-pkg-config:pkgconf-pkg-config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf-pkg-config:pkgconf_pkg_config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf_pkg_config:pkgconf-pkg-config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf_pkg_config:pkgconf_pkg_config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf-pkg:pkgconf-pkg-config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf-pkg:pkgconf_pkg_config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf_pkg:pkgconf-pkg-config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf_pkg:pkgconf_pkg_config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf:pkgconf-pkg-config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:pkgconf:pkgconf_pkg_config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pkgconf-pkg-config:1.7.3-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pkgconf_pkg_config:1.7.3-10.el9:*:*:*:*:*:*:*"],"name":"pkgconf-pkg-config","purl":"pkg:rpm/redhat/pkgconf-pkg-config@1.7.3-10.el9?arch=x86_64&distro=rhel-9.9&upstream=pkgconf-1.7.3-10.el9.src.rpm","type":"rpm","version":"1.7.3-10.el9","language":"","licenses":["ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pkgconf","version":"1.7.3-10.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"pkgconf","version":"1.7.3-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-24056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"risk":0.246925,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-24056","description":"A flaw was found in pkgconf, where a variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. This issue may lead to a buffer overflow, which can crash the software."},"relatedVulnerabilities":[{"id":"CVE-2023-24056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24056","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24056","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24056","date":"2026-11-12","epss":0.00581,"percentile":0.48276}],"urls":["https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059","https://github.com/pkgconf/pkgconf/tags","https://nullprogram.com/blog/2023/01/18/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.24379999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107778","description":"A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"4c25fee2cfae258c","cpes":["cpe:2.3:a:redhat:glibc:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-122054","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"0:2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-122054","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"risk":0.24307000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-122054","description":"A flaw was found in glibc. When converting crafted text using the BIG-HKSCS character set, such as through the iconv library function, the conversion routine can fail to advance and enter an infinite loop. A remote attacker could exploit this vulnerability by submitting malicious input to an application that processes this encoding, resulting in a Denial of Service (DoS) as the application hangs indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-122054","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=25734","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026","http://www.openwall.com/lists/oss-security/2026/11/04/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-122054","description":"Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang."}]},{"artifact":{"id":"2c72752d878f9ef2","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-290.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-122054","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-122054","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"risk":0.24307000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-122054","description":"A flaw was found in glibc. When converting crafted text using the BIG-HKSCS character set, such as through the iconv library function, the conversion routine can fail to advance and enter an infinite loop. A remote attacker could exploit this vulnerability by submitting malicious input to an application that processes this encoding, resulting in a Denial of Service (DoS) as the application hangs indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-122054","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=25734","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026","http://www.openwall.com/lists/oss-security/2026/11/04/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-122054","description":"Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang."}]},{"artifact":{"id":"d137bf3e614f891e","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-290.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-122054","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-122054","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"risk":0.24307000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-122054","description":"A flaw was found in glibc. When converting crafted text using the BIG-HKSCS character set, such as through the iconv library function, the conversion routine can fail to advance and enter an infinite loop. A remote attacker could exploit this vulnerability by submitting malicious input to an application that processes this encoding, resulting in a Denial of Service (DoS) as the application hangs indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-122054","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=25734","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026","http://www.openwall.com/lists/oss-security/2026/11/04/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-122054","description":"Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-12","epss":0.00471,"percentile":0.41238}],"risk":0.242565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-12","epss":0.00471,"percentile":0.41238}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-12","epss":0.00471,"percentile":0.41238}],"risk":0.242565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-12","epss":0.00471,"percentile":0.41238}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"risk":0.24153499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92389","description":"A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server."},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"risk":0.24153499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92389","description":"A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server."},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-12","epss":0.00414,"percentile":0.36145}],"risk":0.23804999999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-12","epss":0.00414,"percentile":0.36145}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-12","epss":0.00414,"percentile":0.36145}],"risk":0.23804999999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-12","epss":0.00414,"percentile":0.36145}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"987c8daac6c0f9f4","cpes":["cpe:2.3:a:libsolv:libsolv:0.7.24-6.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsolv:0.7.24-6.el9_8:*:*:*:*:*:*:*"],"name":"libsolv","purl":"pkg:rpm/redhat/libsolv@0.7.24-6.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libsolv-0.7.24-6.el9_8.src.rpm","type":"rpm","version":"0.7.24-6.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9150","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libsolv","version":"0:0.7.24-6.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9150","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9150","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-9150","date":"2026-11-12","epss":0.00409,"percentile":0.35638}],"risk":0.23517499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9150","description":"A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-9150","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9150","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-9150","date":"2026-11-12","epss":0.00409,"percentile":0.35638}],"urls":["https://access.redhat.com/errata/RHSA-2026:21333","https://access.redhat.com/errata/RHSA-2026:28236","https://access.redhat.com/errata/RHSA-2026:30649","https://access.redhat.com/errata/RHSA-2026:48818","https://access.redhat.com/security/cve/CVE-2026-9150","https://bugzilla.redhat.com/show_bug.cgi?id=2460379","https://github.com/openSUSE/libsolv/pull/616"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9150","description":"A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system."}]},{"artifact":{"id":"57d863142a15e7aa","cpes":["cpe:2.3:a:cyrus-sasl-lib:cyrus-sasl-lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl-lib:cyrus_sasl_lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl_lib:cyrus-sasl-lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl_lib:cyrus_sasl_lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl:cyrus-sasl-lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl:cyrus_sasl_lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl:cyrus-sasl-lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl:cyrus_sasl_lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cyrus-sasl-lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cyrus_sasl_lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus:cyrus-sasl-lib:2.1.27-22.el9:*:*:*:*:*:*:*","cpe:2.3:a:cyrus:cyrus_sasl_lib:2.1.27-22.el9:*:*:*:*:*:*:*"],"name":"cyrus-sasl-lib","purl":"pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-22.el9?arch=x86_64&distro=rhel-9.9&upstream=cyrus-sasl-2.1.27-22.el9.src.rpm","type":"rpm","version":"2.1.27-22.el9","language":"","licenses":["BSD with advertising"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cyrus-sasl","version":"2.1.27-22.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"cyrus-sasl","version":"2.1.27-22.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-12","epss":0.00376,"percentile":0.32022}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-12","epss":0.00376,"percentile":0.32022}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"risk":0.23349499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28387","description":"A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records."},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"risk":0.23349499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28387","description":"A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records."},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"risk":0.23349499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28387","description":"A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records."},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"risk":0.23162500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-117610","description":"A flaw was found in expat. A remote attacker who controls input stream chunking can trigger a NULL pointer dereference by forcing an empty initial parse on an external entity subparser. Successful exploitation causes the application to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42765","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-42765","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-12","epss":0.00508,"percentile":0.43913}],"risk":0.22606000000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42765","description":"A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-42765","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-12","epss":0.00508,"percentile":0.43913}],"urls":["https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334","https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","description":"Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42765","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-42765","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-12","epss":0.00508,"percentile":0.43913}],"risk":0.22606000000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42765","description":"A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-42765","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-12","epss":0.00508,"percentile":0.43913}],"urls":["https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334","https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","description":"Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42765","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-42765","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-12","epss":0.00508,"percentile":0.43913}],"risk":0.22606000000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42765","description":"A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-42765","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-12","epss":0.00508,"percentile":0.43913}],"urls":["https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334","https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","description":"Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-3360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-3360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-11-12","epss":0.00662,"percentile":0.52171}],"risk":0.22177,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."},"relatedVulnerabilities":[{"id":"CVE-2025-3360","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-11-12","epss":0.00662,"percentile":0.52171}],"urls":["https://access.redhat.com/security/cve/CVE-2025-3360","https://bugzilla.redhat.com/show_bug.cgi?id=2357754","https://gitlab.gnome.org/GNOME/glib/-/issues/3647","https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://gitlab.gnome.org/GNOME/glib/-/work_items/3647"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."}]},{"artifact":{"id":"caf0ed3fd4e157a1","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.3.3-9.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtirpc:1.3.3-9.el9:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:rpm/redhat/libtirpc@1.3.3-9.el9?arch=x86_64&distro=rhel-9.9&upstream=libtirpc-1.3.3-9.el9.src.rpm","type":"rpm","version":"1.3.3-9.el9","language":"","licenses":["SISSL and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libtirpc","version":"0:1.3.3-9.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"risk":0.2163,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"risk":0.21309500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-118370","description":"A flaw was found in expat. An integer overflow in the XML attribute parsing logic allows a remote attacker to cause memory corruption and a Denial of Service (DoS). By supplying a specially crafted XML document containing an excessively large number of attributes, an attacker can trigger out-of-bounds memory writes, leading to an application crash."},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119379","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"risk":0.21267,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119379","description":"A flaw was found in SQLite's session extension. A local attacker can supply a specially crafted changeset containing inconsistent table definitions, causing the application to write data past allocated memory boundaries. This heap-based buffer overflow results in memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-119379","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}]},{"artifact":{"id":"215e5e46fa234bcc","cpes":["cpe:2.3:a:perl-HTTP-Tiny:perl-HTTP-Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl-HTTP-Tiny:perl_HTTP_Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl_HTTP_Tiny:perl-HTTP-Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl_HTTP_Tiny:perl_HTTP_Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl-HTTP:perl-HTTP-Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl-HTTP:perl_HTTP_Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl_HTTP:perl-HTTP-Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl_HTTP:perl_HTTP_Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-HTTP-Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_HTTP_Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-HTTP-Tiny:0.076-462.el9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_HTTP_Tiny:0.076-462.el9:*:*:*:*:*:*:*"],"name":"perl-HTTP-Tiny","purl":"pkg:rpm/redhat/perl-HTTP-Tiny@0.076-462.el9?arch=noarch&distro=rhel-9.9&upstream=perl-HTTP-Tiny-0.076-462.el9.src.rpm","type":"rpm","version":"0.076-462.el9","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl-HTTP-Tiny","version":"0:0.076-462.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"risk":0.20527499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7017","description":"A flaw was found in HTTP::Tiny. This vulnerability allows a remote attacker to obtain sensitive credential headers, such as Authorization, Cookie, and Proxy-Authorization, by redirecting a user's request to a different origin. When HTTP::Tiny follows a server's redirect, it fails to verify if the new destination shares the same origin as the original request. This can lead to the unintended disclosure of credentials, including over unencrypted connections if redirected from HTTPS to HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-12","epss":0.00584,"percentile":0.48411}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1489","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-1489","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-11-12","epss":0.00366,"percentile":0.30879}],"risk":0.19032000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."},"relatedVulnerabilities":[{"id":"CVE-2026-1489","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-11-12","epss":0.00366,"percentile":0.30879}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1489","https://bugzilla.redhat.com/show_bug.cgi?id=2433348","https://gitlab.gnome.org/GNOME/glib/-/issues/3872","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."}]},{"artifact":{"id":"9d12cc6e52853529","cpes":["cpe:2.3:a:redhat:gawk:5.1.0-7.el9:*:*:*:*:*:*:*","cpe:2.3:a:gawk:gawk:5.1.0-7.el9:*:*:*:*:*:*:*"],"name":"gawk","purl":"pkg:rpm/redhat/gawk@5.1.0-7.el9?arch=x86_64&distro=rhel-9.9&upstream=gawk-5.1.0-7.el9.src.rpm","type":"rpm","version":"5.1.0-7.el9","language":"","licenses":["GPLv3+ and GPLv2+ and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-4156","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gawk","version":"0:5.1.0-7.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-4156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4156","date":"2026-11-12","epss":0.00415,"percentile":0.36323}],"risk":0.188825,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-4156","description":"A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2023-4156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4156","date":"2026-11-12","epss":0.00415,"percentile":0.36323}],"urls":["https://access.redhat.com/security/cve/CVE-2023-4156","https://bugzilla.redhat.com/show_bug.cgi?id=2215930"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4156","description":"A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information."}]},{"artifact":{"id":"e988ae274c693810","cpes":["cpe:2.3:a:redhat:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=rhel-9.9&epoch=2&upstream=tar-1.34-13.el9_8.src.rpm","type":"rpm","version":"2:1.34-13.el9_8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"tar","version":"2:1.34-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-33056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-11-12","epss":0.00394,"percentile":0.34101}],"risk":0.18518,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-33056","description":"A flaw was found in tar-rs, a Rust library for reading and writing tar archives. When unpacking a crafted tar archive, an attacker can exploit a symbolic link vulnerability. By including a symlink followed by a directory with the same name, the library incorrectly applies file permissions to the symlink's target. This allows an attacker to modify the permissions of arbitrary directories outside the intended extraction location."},"relatedVulnerabilities":[{"id":"CVE-2026-33056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-11-12","epss":0.00394,"percentile":0.34101}],"urls":["https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446","https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-12","epss":0.0048,"percentile":0.41915}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-12","epss":0.0048,"percentile":0.41915}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-12","epss":0.0048,"percentile":0.41915}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-12","epss":0.0048,"percentile":0.41915}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"e988ae274c693810","cpes":["cpe:2.3:a:redhat:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=rhel-9.9&epoch=2&upstream=tar-1.34-13.el9_8.src.rpm","type":"rpm","version":"2:1.34-13.el9_8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59875","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"tar","version":"2:1.34-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-59875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59875","date":"2026-11-12","epss":0.00354,"percentile":0.29581}],"risk":0.18231000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59875","description":"A flaw was found in node-tar, a library for manipulating tar archives in Node.js. A remote attacker could craft a malicious archive containing null characters (NUL bytes) in its metadata. When this archive is processed, the unstripped null characters can cause the application to terminate unexpectedly, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-59875","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59875","date":"2026-11-12","epss":0.00354,"percentile":0.29581}],"urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4426","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-4426","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-11-12","epss":0.00317,"percentile":0.2503}],"risk":0.182275,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-4426","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-11-12","epss":0.00317,"percentile":0.2503}],"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-4426","https://bugzilla.redhat.com/show_bug.cgi?id=2449010","https://github.com/libarchive/libarchive/pull/2897"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"987c8daac6c0f9f4","cpes":["cpe:2.3:a:libsolv:libsolv:0.7.24-6.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsolv:0.7.24-6.el9_8:*:*:*:*:*:*:*"],"name":"libsolv","purl":"pkg:rpm/redhat/libsolv@0.7.24-6.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libsolv-0.7.24-6.el9_8.src.rpm","type":"rpm","version":"0.7.24-6.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9149","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libsolv","version":"0:0.7.24-6.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-9149","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9149","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-9149","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"risk":0.17939999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9149","description":"A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-9149","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9149","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-9149","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"urls":["https://access.redhat.com/errata/RHSA-2026:21333","https://access.redhat.com/errata/RHSA-2026:28236","https://access.redhat.com/errata/RHSA-2026:48818","https://access.redhat.com/security/cve/CVE-2026-9149","https://bugzilla.redhat.com/show_bug.cgi?id=2460380","https://github.com/openSUSE/libsolv/pull/617"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9149","description":"A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS)."}]},{"artifact":{"id":"bb911813b45585f3","cpes":["cpe:2.3:a:perl-AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-AutoLoader","purl":"pkg:rpm/redhat/perl-AutoLoader@5.74-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:5.74-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"7e60fe54e6c09824","cpes":["cpe:2.3:a:perl-B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-B","purl":"pkg:rpm/redhat/perl-B@1.80-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.80-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"006f5e08bfc4c952","cpes":["cpe:2.3:a:perl-Class-Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class-Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Class-Struct","purl":"pkg:rpm/redhat/perl-Class-Struct@0.66-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.66-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"2a9a518a53c7512b","cpes":["cpe:2.3:a:perl-Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Errno","purl":"pkg:rpm/redhat/perl-Errno@1.30-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.30-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"f01ef4b3b3b90538","cpes":["cpe:2.3:a:perl-Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Fcntl","purl":"pkg:rpm/redhat/perl-Fcntl@1.13-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.13-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"965edf03abd14e95","cpes":["cpe:2.3:a:perl-File-Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-Basename","purl":"pkg:rpm/redhat/perl-File-Basename@2.85-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.85-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"7cb125d521892030","cpes":["cpe:2.3:a:perl-File-stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-stat","purl":"pkg:rpm/redhat/perl-File-stat@1.09-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.09-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"67e8889d83c474fb","cpes":["cpe:2.3:a:perl-FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-FileHandle","purl":"pkg:rpm/redhat/perl-FileHandle@2.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"955cb53aefe39959","cpes":["cpe:2.3:a:perl-Getopt-Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt-Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Getopt-Std","purl":"pkg:rpm/redhat/perl-Getopt-Std@1.12-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.12-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"e824797a395c58fc","cpes":["cpe:2.3:a:perl-IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IO","purl":"pkg:rpm/redhat/perl-IO@1.43-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.43-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"42816d98549babcf","cpes":["cpe:2.3:a:perl-IPC-Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC-Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IPC-Open3","purl":"pkg:rpm/redhat/perl-IPC-Open3@1.21-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.21-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"7db8a261840c5baa","cpes":["cpe:2.3:a:perl-NDBM-File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-NDBM_File","purl":"pkg:rpm/redhat/perl-NDBM_File@1.15-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.15-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"4d811d3afb2547c9","cpes":["cpe:2.3:a:perl-POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-POSIX","purl":"pkg:rpm/redhat/perl-POSIX@1.94-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.94-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"1bc88a0c5a9ab30a","cpes":["cpe:2.3:a:perl-SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-SelectSaver","purl":"pkg:rpm/redhat/perl-SelectSaver@1.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"449e2b4e3fa8b962","cpes":["cpe:2.3:a:perl-Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Symbol","purl":"pkg:rpm/redhat/perl-Symbol@1.08-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.08-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"21c1a8a82e4461bf","cpes":["cpe:2.3:a:perl-base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:rpm/redhat/perl-base@2.27-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.27-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"a0ae61863ea1a76d","cpes":["cpe:2.3:a:perl-if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-if","purl":"pkg:rpm/redhat/perl-if@0.60.800-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.60.800-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"4ac7ee895d3c99ec","cpes":["cpe:2.3:a:perl-interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-interpreter","purl":"pkg:rpm/redhat/perl-interpreter@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"bf2c1b6ec909c416","cpes":["cpe:2.3:a:perl-libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-libs","purl":"pkg:rpm/redhat/perl-libs@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["(GPL+ or Artistic) and BSD and HSRL and MIT and UCD and Public domain"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"8deef1192afd481d","cpes":["cpe:2.3:a:perl-mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-mro","purl":"pkg:rpm/redhat/perl-mro@1.23-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.23-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"9b9db6c4ad38ca1b","cpes":["cpe:2.3:a:perl-overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overload","purl":"pkg:rpm/redhat/perl-overload@1.31-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.31-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"e12188ce897a6a75","cpes":["cpe:2.3:a:perl-overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overloading","purl":"pkg:rpm/redhat/perl-overloading@0.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"103e8134631ed773","cpes":["cpe:2.3:a:perl-subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-subs","purl":"pkg:rpm/redhat/perl-subs@1.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"7a082b0e6a9156ba","cpes":["cpe:2.3:a:perl-vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-vars","purl":"pkg:rpm/redhat/perl-vars@1.05-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.05-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-45190","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45190","description":"A flaw was found in Net::CIDR::Lite, a Perl module for handling IP address ranges. This vulnerability allows a remote attacker to bypass IP Access Control Lists (ACLs) due to improper validation of IP address and CIDR (Classless Inter-Domain Routing) mask inputs. Specifically, inputs containing trailing newlines or non-ASCII digit characters are incorrectly processed, leading to a mismatch between the intended and actual IP addresses. This can cause functions like `find()` and `bin_find()` to incorrectly allow or deny access, compromising network security policies."},"relatedVulnerabilities":[{"id":"CVE-2026-45190","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45190","cwe":"CWE-1289","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-45190","date":"2026-11-12","epss":0.00311,"percentile":0.24313}],"urls":["https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch","https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","https://www.cve.org/CVERecord?id=CVE-2026-45191"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45190","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.\n\nInputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new();\n  $cidr->add(\"::1\\n/128\");\n  $cidr->find(\"::1a\");  # incorrectly returns true\n\nSee also CVE-2026-45191."}]},{"artifact":{"id":"4c25fee2cfae258c","cpes":["cpe:2.3:a:redhat:glibc:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"0:2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1782,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84243","description":"A flaw was found in glibc. The library's localization functions fail to properly sanitize directory traversal characters within the LANGUAGE environment variable. A local attacker capable of setting this variable across trust boundaries can force a target program to load a malicious translation file from an arbitrary filesystem location. This issue can lead to arbitrary code execution under the privileges of the running application or cause an application crash, resulting in a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"2c72752d878f9ef2","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-290.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1782,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84243","description":"A flaw was found in glibc. The library's localization functions fail to properly sanitize directory traversal characters within the LANGUAGE environment variable. A local attacker capable of setting this variable across trust boundaries can force a target program to load a malicious translation file from an arbitrary filesystem location. This issue can lead to arbitrary code execution under the privileges of the running application or cause an application crash, resulting in a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"d137bf3e614f891e","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-290.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1782,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84243","description":"A flaw was found in glibc. The library's localization functions fail to properly sanitize directory traversal characters within the LANGUAGE environment variable. A local attacker capable of setting this variable across trust boundaries can force a target program to load a malicious translation file from an arbitrary filesystem location. This issue can lead to arbitrary code execution under the privileges of the running application or cause an application crash, resulting in a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"b339e2733f09ab11","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.13-18.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=libxml2-2.9.13-18.el9_9.1.src.rpm","type":"rpm","version":"2.9.13-18.el9_9.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0989","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libxml2","version":"0:2.9.13-18.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-0989","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-11-12","epss":0.0053,"percentile":0.45327}],"risk":0.17754999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."},"relatedVulnerabilities":[{"id":"CVE-2026-0989","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-11-12","epss":0.0053,"percentile":0.45327}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0989","https://bugzilla.redhat.com/show_bug.cgi?id=2429933","https://gitlab.gnome.org/GNOME/libxml2/-/issues/998"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119374","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-12","epss":0.0023,"percentile":0.13979}],"risk":0.17595,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119374","description":"A flaw was found in SQLite. When the Full Text Search (FTS5) extension is enabled and secure-delete mode is active, processing a database containing a corrupted search index triggers a heap-based buffer overflow. An attacker who tricks an application or user into opening a crafted database file can exploit this flaw to execute arbitrary code or cause a Denial of Service (DoS) by crashing the application."},"relatedVulnerabilities":[{"id":"CVE-2026-119374","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-12","epss":0.0023,"percentile":0.13979}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"risk":0.17513999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-94266","description":"A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file (such as a .netrc file), requesting the effective URL metadata can cause the returned destination address to improperly include those secret credentials. A local user may exploit this issue to view sensitive authentication tokens if an application or script queries and logs or displays the resolved URL."},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"risk":0.17513999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-94266","description":"A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file (such as a .netrc file), requesting the effective URL metadata can cause the returned destination address to improperly include those secret credentials. A local user may exploit this issue to view sensitive authentication tokens if an application or script queries and logs or displays the resolved URL."},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"caf0ed3fd4e157a1","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.3.3-9.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtirpc:1.3.3-9.el9:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:rpm/redhat/libtirpc@1.3.3-9.el9?arch=x86_64&distro=rhel-9.9&upstream=libtirpc-1.3.3-9.el9.src.rpm","type":"rpm","version":"1.3.3-9.el9","language":"","licenses":["SISSL and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libtirpc","version":"0:1.3.3-9.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"risk":0.17077499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-12","epss":0.00329,"percentile":0.26344}],"risk":0.169435,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-12","epss":0.00329,"percentile":0.26344}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-12","epss":0.00329,"percentile":0.26344}],"risk":0.169435,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-12","epss":0.00329,"percentile":0.26344}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"965c5108ab84fcf4","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=rhel-9.9&upstream=gnupg2-2.3.3-5.el9_7.src.rpm","type":"rpm","version":"2.3.3-5.el9_7","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24883","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gnupg2","version":"0:2.3.3-5.el9_7"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-24883","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24883","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24883","date":"2026-11-12","epss":0.00486,"percentile":0.42398}],"risk":0.16280999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-24883","description":"A flaw was found in GnuPG. A remote attacker could provide a specially crafted long signature packet that, when processed, causes the application to crash. This vulnerability leads to a denial of service (DoS), making the GnuPG application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-24883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24883","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24883","date":"2026-11-12","epss":0.00486,"percentile":0.42398}],"urls":["https://dev.gnupg.org/T8049","https://www.openwall.com/lists/oss-security/2026/01/27/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24883","description":"In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash)."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-70873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-70873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-11-12","epss":0.005,"percentile":0.43369}],"risk":0.15749999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-70873","description":"A flaw was found in SQLite. This information disclosure vulnerability exists within the zipfile extension, specifically in the zipfileInflate function. A remote attacker could exploit this by providing a specially crafted ZIP file. Successful exploitation could lead to the disclosure of sensitive heap memory information."},"relatedVulnerabilities":[{"id":"CVE-2025-70873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-11-12","epss":0.005,"percentile":0.43369}],"urls":["https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054","https://sqlite.org/forum/forumpost/761eac3c82","https://sqlite.org/src/info/3d459f1fb1bd1b5e","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1484","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-1484","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-11-12","epss":0.00341,"percentile":0.28024}],"risk":0.15686,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."},"relatedVulnerabilities":[{"id":"CVE-2026-1484","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-11-12","epss":0.00341,"percentile":0.28024}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1484","https://bugzilla.redhat.com/show_bug.cgi?id=2433259","https://gitlab.gnome.org/GNOME/glib/-/issues/3870","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2024-0232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0232","date":"2026-11-12","epss":0.00381,"percentile":0.3257}],"risk":0.146685,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-0232","description":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-0232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0232","date":"2026-11-12","epss":0.00381,"percentile":0.3257}],"urls":["https://access.redhat.com/security/cve/CVE-2024-0232","https://bugzilla.redhat.com/show_bug.cgi?id=2243754","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/","https://security.netapp.com/advisory/ntap-20240315-0007/","https://cert-portal.siemens.com/productcert/html/ssa-000297.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0232","description":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0988","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-0988","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"risk":0.14539,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-0988","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"urls":["https://access.redhat.com/errata/RHSA-2026:7461","https://access.redhat.com/security/cve/CVE-2026-0988","https://bugzilla.redhat.com/show_bug.cgi?id=2429886","https://gitlab.gnome.org/GNOME/glib/-/issues/3851"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-7039","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-7039","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-11-12","epss":0.00434,"percentile":0.38115}],"risk":0.14539,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."},"relatedVulnerabilities":[{"id":"CVE-2025-7039","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-11-12","epss":0.00434,"percentile":0.38115}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7039","https://bugzilla.redhat.com/show_bug.cgi?id=2392423","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-12","epss":0.00239,"percentile":0.15075}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-12","epss":0.00239,"percentile":0.15075}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-12","epss":0.00239,"percentile":0.15075}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-12","epss":0.00239,"percentile":0.15075}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"b47dd00953817b05","cpes":["cpe:2.3:a:libmodulemd:libmodulemd:2.13.0-2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmodulemd:2.13.0-2.el9:*:*:*:*:*:*:*"],"name":"libmodulemd","purl":"pkg:rpm/redhat/libmodulemd@2.13.0-2.el9?arch=x86_64&distro=rhel-9.9&upstream=libmodulemd-2.13.0-2.el9.src.rpm","type":"rpm","version":"2.13.0-2.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92822","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libmodulemd","version":"0:2.13.0-2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92822","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92822","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92822","date":"2026-11-12","epss":0.00251,"percentile":0.16659}],"risk":0.14056000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92822","description":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-92822","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92822","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92822","date":"2026-11-12","epss":0.00251,"percentile":0.16659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-92822","https://bugzilla.redhat.com/show_bug.cgi?id=2479002","https://github.com/advisories/GHSA-85r9-7wj5-x6x5","https://github.com/fedora-modularity/libmodulemd/pull/645"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92822","description":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5918","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-5918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-11-12","epss":0.00393,"percentile":0.33998}],"risk":0.135585,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2025-5918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-11-12","epss":0.00393,"percentile":0.33998}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5918","https://bugzilla.redhat.com/show_bug.cgi?id=2370877","https://github.com/libarchive/libarchive/pull/2584","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11850","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-11850","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-12","epss":0.00271,"percentile":0.19542}],"risk":0.1355,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."},"relatedVulnerabilities":[{"id":"CVE-2026-11850","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-12","epss":0.00271,"percentile":0.19542}],"urls":["https://access.redhat.com/errata/RHSA-2026:25520","https://access.redhat.com/security/cve/CVE-2026-11850","https://bugzilla.redhat.com/show_bug.cgi?id=2459970"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."}]},{"artifact":{"id":"b339e2733f09ab11","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.13-18.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=libxml2-2.9.13-18.el9_9.1.src.rpm","type":"rpm","version":"2.9.13-18.el9_9.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0992","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libxml2","version":"0:2.9.13-18.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-0992","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-11-12","epss":0.00459,"percentile":0.40234}],"risk":0.135405,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2026-0992","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-11-12","epss":0.00459,"percentile":0.40234}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0992","https://bugzilla.redhat.com/show_bug.cgi?id=2429975","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."}]},{"artifact":{"id":"965c5108ab84fcf4","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=rhel-9.9&upstream=gnupg2-2.3.3-5.el9_7.src.rpm","type":"rpm","version":"2.3.3-5.el9_7","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gnupg2","version":"0:2.3.3-5.el9_7"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-12","epss":0.00293,"percentile":0.22149}],"risk":0.13477999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-3219","description":"A vulnerability was found in GnuPG. GnuPG can spin on a relatively small input by crafting a public key with thousands of signatures attached and compressed down to a few kilobytes. This issue can potentially cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-12","epss":0.00293,"percentile":0.22149}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-41080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-11-12","epss":0.00398,"percentile":0.34532}],"risk":0.13333,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41080","description":"A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing a specially crafted XML document that leverages insufficient entropy in the hash function. This can lead to hash flooding, a type of Denial of Service (DoS) attack, where the system becomes unresponsive or crashes due to excessive resource consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-41080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-11-12","epss":0.00398,"percentile":0.34532}],"urls":["https://blog.hartwork.org/posts/expat-2-8-0-released/","https://github.com/libexpat/libexpat/issues/47","https://github.com/libexpat/libexpat/pull/1183","https://www.openwall.com/lists/oss-security/2026/04/26/1","http://www.openwall.com/lists/oss-security/2026/04/26/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41080","description":"libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119378","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"risk":0.131775,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119378","description":"A flaw was found in SQLite. A use-after-free vulnerability in the R-Tree extension allows an attacker to cause a Denial of Service (DoS) by convincing a user or service to process a specially crafted database. By manipulating internal shadow tables used by the extension, the application improperly accesses previously freed memory during index operations, causing the process to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-119378","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."}]},{"artifact":{"id":"cbdfa30db142aa04","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-9.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-9.el9_8:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-9.el9_8?arch=x86_64&distro=rhel-9.9&upstream=gnutls-3.8.10-9.el9_8.src.rpm","type":"rpm","version":"3.8.10-9.el9_8","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88648","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gnutls","version":"0:3.8.10-9.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-88648","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88648","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88648","date":"2026-11-12","epss":0.00202,"percentile":0.103}],"risk":0.12524000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-88648","description":"A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority (CA) can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure (PKI) restrictions. This allows unauthorized certificates to be accepted as valid, potentially enabling the attacker to impersonate trusted domains and intercept secure communications."},"relatedVulnerabilities":[{"id":"CVE-2026-88648","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88648","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88648","date":"2026-11-12","epss":0.00202,"percentile":0.103}],"urls":["https://gist.github.com/lkloliver/1f2a97cb8d0b31aa27b6bd0354358d7d","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10","https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4","https://github.com/lkloliver/poc/tree/main/CVE-2026-88648"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88648","description":"In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-12","epss":0.00371,"percentile":0.31519}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-12","epss":0.00371,"percentile":0.31519}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-12","epss":0.00371,"percentile":0.31519}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-12","epss":0.00371,"percentile":0.31519}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119373","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"risk":0.12393,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119373","description":"A flaw was found in SQLite. A heap-based buffer overflow exists in the Full-Text Search 5 (FTS5) extension during the merging of prefix document lists. An attacker capable of inserting negative row identifiers into a configured table and executing a prefix search query can cause data to be written beyond allocated memory. This issue can lead to memory corruption, resulting in application crashes, a Denial of Service (DoS), or potentially arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-119373","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."}]},{"artifact":{"id":"b339e2733f09ab11","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.13-18.el9_9.1:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.13-18.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=libxml2-2.9.13-18.el9_9.1.src.rpm","type":"rpm","version":"2.9.13-18.el9_9.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1757","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libxml2","version":"0:2.9.13-18.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-1757","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-11-12","epss":0.00217,"percentile":0.12332}],"risk":0.12152,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."},"relatedVulnerabilities":[{"id":"CVE-2026-1757","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-11-12","epss":0.00217,"percentile":0.12332}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-1757","https://bugzilla.redhat.com/show_bug.cgi?id=2435940","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."}]},{"artifact":{"id":"e23cfc4398093f3b","cpes":["cpe:2.3:a:diffutils:diffutils:3.7-12.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:diffutils:3.7-12.el9:*:*:*:*:*:*:*"],"name":"diffutils","purl":"pkg:rpm/redhat/diffutils@3.7-12.el9?arch=x86_64&distro=rhel-9.9&upstream=diffutils-3.7-12.el9.src.rpm","type":"rpm","version":"3.7-12.el9","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53910","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"diffutils","version":"0:3.7-12.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-53910","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-11-12","epss":0.00291,"percentile":0.22007}],"risk":0.120765,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53910","description":"A flaw was found in the diff3 program in the diffutils package. When processing specially crafted diff output, a heap-based buffer overflow can occur due to multiple signed integer overflows in line-mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds, resulting in a denial of service or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-53910","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-11-12","epss":0.00291,"percentile":0.22007}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-53910","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815","https://git.savannah.gnu.org/cgit/diffutils.git/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53910","description":"diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.\nWhen processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. \nAn attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.\n\n\nThis issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 \n\nNOTE:\nThe project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges."}]},{"artifact":{"id":"6b29b8ef2f83cc22","cpes":["cpe:2.3:a:redhat:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"0:4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.12032,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"108e4bcd5f0cf305","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-40.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"risk":0.12032,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-11-12","epss":0.00188,"percentile":0.0852}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"6b29b8ef2f83cc22","cpes":["cpe:2.3:a:redhat:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:4.16.1.3-43.el9_9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"< 0:4.16.1.3-43.el9_9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"0:4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"fixed","versions":["0:4.16.1.3-43.el9_9"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:4.16.1.3-43.el9_9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-12","epss":0.00199,"percentile":0.09776}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99593","link":"https://access.redhat.com/errata/RHSA-2026:99593"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-12","epss":0.00199,"percentile":0.09776}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"108e4bcd5f0cf305","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-40.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:4.16.1.3-43.el9_9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"< 0:4.16.1.3-43.el9_9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"fixed","versions":["0:4.16.1.3-43.el9_9"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:4.16.1.3-43.el9_9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-12","epss":0.00199,"percentile":0.09776}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99593","link":"https://access.redhat.com/errata/RHSA-2026:99593"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-12","epss":0.00199,"percentile":0.09776}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/errata/RHSA-2026:99593","https://access.redhat.com/errata/RHSA-2026:99595","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-12","epss":0.00373,"percentile":0.31734}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-12","epss":0.00373,"percentile":0.31734}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-12","epss":0.00373,"percentile":0.31734}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-12","epss":0.00373,"percentile":0.31734}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56406","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56406","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56406","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56406","date":"2026-11-12","epss":0.00188,"percentile":0.08554}],"risk":0.11186,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56406","description":"A flaw was found in libexpat. An integer overflow vulnerability exists in the `XML_ParseBuffer` function due to a missing check. This flaw could allow an attacker to cause memory corruption, potentially leading to arbitrary code execution, information disclosure, or a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-56406","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56406","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56406","date":"2026-11-12","epss":0.00188,"percentile":0.08554}],"urls":["https://github.com/libexpat/libexpat/pull/1255","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56406","description":"libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56407","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56407","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56407","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56407","date":"2026-11-12","epss":0.00188,"percentile":0.08554}],"risk":0.11186,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56407","description":"An integer overflow exists in libexpat's doProlog function due to improper handling of entity value lengths. A local attacker could exploit this to execute arbitrary code or access sensitive system data."},"relatedVulnerabilities":[{"id":"CVE-2026-56407","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56407","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56407","date":"2026-11-12","epss":0.00188,"percentile":0.08554}],"urls":["https://github.com/libexpat/libexpat/pull/1262","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56407","description":"libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen."}]},{"artifact":{"id":"0af7e0fddee0cee7","cpes":["cpe:2.3:a:openssl:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-31789","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"1:3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-31789","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-12","epss":0.00253,"percentile":0.16921}],"risk":0.11132,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-31789","description":"A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment."},"relatedVulnerabilities":[{"id":"CVE-2026-31789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-12","epss":0.00253,"percentile":0.16921}],"urls":["https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde","https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf","https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49","https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9","https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","description":"Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"562a21bb9a6b4a71","cpes":["cpe:2.3:a:openssl-devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_devel:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_devel:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31789","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-31789","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-12","epss":0.00253,"percentile":0.16921}],"risk":0.11132,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-31789","description":"A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment."},"relatedVulnerabilities":[{"id":"CVE-2026-31789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-12","epss":0.00253,"percentile":0.16921}],"urls":["https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde","https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf","https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49","https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9","https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","description":"Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"946505b3535e0921","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.9-1.el9_9:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.9-1.el9_9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=openssl-3.5.9-1.el9_9.src.rpm","type":"rpm","version":"1:3.5.9-1.el9_9","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.9-1.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31789","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openssl","version":"3.5.9-1.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-31789","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-12","epss":0.00253,"percentile":0.16921}],"risk":0.11132,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-31789","description":"A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment."},"relatedVulnerabilities":[{"id":"CVE-2026-31789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-12","epss":0.00253,"percentile":0.16921}],"urls":["https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde","https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf","https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49","https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9","https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","description":"Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56403","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56403","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56403","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56403","date":"2026-11-12","epss":0.00182,"percentile":0.07898}],"risk":0.10829,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56403","description":"A flaw was found in libexpat. An integer overflow vulnerability exists in the `storeAtts` function. This flaw could allow an attacker to corrupt memory, leading to a denial of service, information disclosure, or potentially arbitrary code execution, compromising the integrity and confidentiality of data."},"relatedVulnerabilities":[{"id":"CVE-2026-56403","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56403","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56403","date":"2026-11-12","epss":0.00182,"percentile":0.07898}],"urls":["https://github.com/libexpat/libexpat/pull/1232","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-60753","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-60753","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-11-12","epss":0.00206,"percentile":0.10795}],"risk":0.10815000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-60753","description":"A vulnerability in apply_substitution() function in libarchive's bsdtar allows crafted -s substitution rules to repeatedly match a zero-length substring and append replacements without advancing the input pointer. When the rule uses the global /g flag (or an explicitly empty pattern), this leads to unbounded output allocation and eventual process OOM (Denial of Service). Upgrade to libarchive 3.8.1 or apply a patch that prevents zero-length match loops or rejects empty patterns."},"relatedVulnerabilities":[{"id":"CVE-2025-60753","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-11-12","epss":0.00206,"percentile":0.10795}],"urls":["https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753","https://github.com/libarchive/libarchive/issues/2725"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60753","description":"An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash)."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32777","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-32777","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32777","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32777","date":"2026-11-12","epss":0.0024,"percentile":0.1529}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32777","description":"A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing specially crafted Document Type Definition (DTD) content. This could lead to an infinite loop during parsing, resulting in a Denial of Service (DoS) for the application using libexpat."},"relatedVulnerabilities":[{"id":"CVE-2026-32777","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32777","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32777","date":"2026-11-12","epss":0.0024,"percentile":0.1529}],"urls":["https://github.com/libexpat/libexpat/issues/1161","https://github.com/libexpat/libexpat/pull/1159","https://github.com/libexpat/libexpat/pull/1162","https://issues.oss-fuzz.com/issues/486993411","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32777","description":"libexpat before 2.7.5 allows an infinite loop while parsing DTD content."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-1632","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-1632","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-11-12","epss":0.00342,"percentile":0.28141}],"risk":0.10772999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1632","description":"A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior. This bug does not compromise the integrity or availability of the base system."},"relatedVulnerabilities":[{"id":"CVE-2025-1632","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-11-12","epss":0.00342,"percentile":0.28141}],"urls":["https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc","https://vuldb.com/?ctiid.296619","https://vuldb.com/?id.296619","https://vuldb.com/?submit.496460"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5915","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-5915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5915","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5915","date":"2026-11-12","epss":0.00223,"percentile":0.13007}],"risk":0.10704,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5915","description":"A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions."},"relatedVulnerabilities":[{"id":"CVE-2025-5915","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5915","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5915","date":"2026-11-12","epss":0.00223,"percentile":0.13007}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5915","https://bugzilla.redhat.com/show_bug.cgi?id=2370865","https://github.com/libarchive/libarchive/pull/2599","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5915","description":"A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions."}]},{"artifact":{"id":"bb911813b45585f3","cpes":["cpe:2.3:a:perl-AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-AutoLoader","purl":"pkg:rpm/redhat/perl-AutoLoader@5.74-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:5.74-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"7e60fe54e6c09824","cpes":["cpe:2.3:a:perl-B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-B","purl":"pkg:rpm/redhat/perl-B@1.80-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.80-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"006f5e08bfc4c952","cpes":["cpe:2.3:a:perl-Class-Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class-Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Class-Struct","purl":"pkg:rpm/redhat/perl-Class-Struct@0.66-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.66-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"2a9a518a53c7512b","cpes":["cpe:2.3:a:perl-Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Errno","purl":"pkg:rpm/redhat/perl-Errno@1.30-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.30-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"f01ef4b3b3b90538","cpes":["cpe:2.3:a:perl-Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Fcntl","purl":"pkg:rpm/redhat/perl-Fcntl@1.13-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.13-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"965edf03abd14e95","cpes":["cpe:2.3:a:perl-File-Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-Basename","purl":"pkg:rpm/redhat/perl-File-Basename@2.85-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.85-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"7cb125d521892030","cpes":["cpe:2.3:a:perl-File-stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-stat","purl":"pkg:rpm/redhat/perl-File-stat@1.09-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.09-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"67e8889d83c474fb","cpes":["cpe:2.3:a:perl-FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-FileHandle","purl":"pkg:rpm/redhat/perl-FileHandle@2.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"955cb53aefe39959","cpes":["cpe:2.3:a:perl-Getopt-Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt-Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Getopt-Std","purl":"pkg:rpm/redhat/perl-Getopt-Std@1.12-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.12-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"e824797a395c58fc","cpes":["cpe:2.3:a:perl-IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IO","purl":"pkg:rpm/redhat/perl-IO@1.43-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.43-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"42816d98549babcf","cpes":["cpe:2.3:a:perl-IPC-Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC-Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IPC-Open3","purl":"pkg:rpm/redhat/perl-IPC-Open3@1.21-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.21-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"7db8a261840c5baa","cpes":["cpe:2.3:a:perl-NDBM-File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-NDBM_File","purl":"pkg:rpm/redhat/perl-NDBM_File@1.15-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.15-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"4d811d3afb2547c9","cpes":["cpe:2.3:a:perl-POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-POSIX","purl":"pkg:rpm/redhat/perl-POSIX@1.94-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.94-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"1bc88a0c5a9ab30a","cpes":["cpe:2.3:a:perl-SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-SelectSaver","purl":"pkg:rpm/redhat/perl-SelectSaver@1.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"449e2b4e3fa8b962","cpes":["cpe:2.3:a:perl-Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Symbol","purl":"pkg:rpm/redhat/perl-Symbol@1.08-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.08-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"21c1a8a82e4461bf","cpes":["cpe:2.3:a:perl-base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:rpm/redhat/perl-base@2.27-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.27-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"a0ae61863ea1a76d","cpes":["cpe:2.3:a:perl-if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-if","purl":"pkg:rpm/redhat/perl-if@0.60.800-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.60.800-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"4ac7ee895d3c99ec","cpes":["cpe:2.3:a:perl-interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-interpreter","purl":"pkg:rpm/redhat/perl-interpreter@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"bf2c1b6ec909c416","cpes":["cpe:2.3:a:perl-libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-libs","purl":"pkg:rpm/redhat/perl-libs@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["(GPL+ or Artistic) and BSD and HSRL and MIT and UCD and Public domain"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"8deef1192afd481d","cpes":["cpe:2.3:a:perl-mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-mro","purl":"pkg:rpm/redhat/perl-mro@1.23-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.23-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"9b9db6c4ad38ca1b","cpes":["cpe:2.3:a:perl-overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overload","purl":"pkg:rpm/redhat/perl-overload@1.31-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.31-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"e12188ce897a6a75","cpes":["cpe:2.3:a:perl-overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overloading","purl":"pkg:rpm/redhat/perl-overloading@0.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"103e8134631ed773","cpes":["cpe:2.3:a:perl-subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-subs","purl":"pkg:rpm/redhat/perl-subs@1.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"7a082b0e6a9156ba","cpes":["cpe:2.3:a:perl-vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-vars","purl":"pkg:rpm/redhat/perl-vars@1.05-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.05-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"risk":0.1065,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57432","description":"A flaw was found in Perl. An integer overflow vulnerability in the `S_measure_struct` function, specifically when handling `pack` and `unpack` templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data."},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-11-12","epss":0.00213,"percentile":0.11697}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"b47dd00953817b05","cpes":["cpe:2.3:a:libmodulemd:libmodulemd:2.13.0-2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmodulemd:2.13.0-2.el9:*:*:*:*:*:*:*"],"name":"libmodulemd","purl":"pkg:rpm/redhat/libmodulemd@2.13.0-2.el9?arch=x86_64&distro=rhel-9.9&upstream=libmodulemd-2.13.0-2.el9.src.rpm","type":"rpm","version":"2.13.0-2.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92824","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libmodulemd","version":"0:2.13.0-2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92824","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92824","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92824","date":"2026-11-12","epss":0.0019,"percentile":0.08759}],"risk":0.10640000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92824","description":"A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-92824","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92824","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92824","date":"2026-11-12","epss":0.0019,"percentile":0.08759}],"urls":["https://access.redhat.com/security/cve/CVE-2026-92824","https://bugzilla.redhat.com/show_bug.cgi?id=2478495","https://github.com/advisories/GHSA-j65x-29mg-x4cj","https://github.com/fedora-modularity/libmodulemd/pull/643"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92824","description":"A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32776","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-32776","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32776","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32776","date":"2026-11-12","epss":0.0019,"percentile":0.08692}],"risk":0.10640000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32776","description":"A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing specially crafted XML content with empty external parameter entities. This could lead to a NULL pointer dereference, causing the application to crash and resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-32776","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32776","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32776","date":"2026-11-12","epss":0.0019,"percentile":0.08692}],"urls":["https://github.com/libexpat/libexpat/pull/1158","https://github.com/libexpat/libexpat/pull/1159","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32776","description":"libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content."}]},{"artifact":{"id":"b47dd00953817b05","cpes":["cpe:2.3:a:libmodulemd:libmodulemd:2.13.0-2.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmodulemd:2.13.0-2.el9:*:*:*:*:*:*:*"],"name":"libmodulemd","purl":"pkg:rpm/redhat/libmodulemd@2.13.0-2.el9?arch=x86_64&distro=rhel-9.9&upstream=libmodulemd-2.13.0-2.el9.src.rpm","type":"rpm","version":"2.13.0-2.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92823","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libmodulemd","version":"0:2.13.0-2.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-92823","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92823","cwe":"CWE-409","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92823","date":"2026-11-12","epss":0.00184,"percentile":0.08059}],"risk":0.10304,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92823","description":"A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-92823","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92823","cwe":"CWE-409","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92823","date":"2026-11-12","epss":0.00184,"percentile":0.08059}],"urls":["https://access.redhat.com/security/cve/CVE-2026-92823","https://bugzilla.redhat.com/show_bug.cgi?id=2478703","https://github.com/advisories/GHSA-x9m8-9g38-v659","https://github.com/fedora-modularity/libmodulemd/pull/644"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92823","description":"A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119375","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119375","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"risk":0.102375,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119375","description":"A flaw was found in SQLite. A local attacker can exploit this vulnerability by providing a crafted database and a Write-Ahead Logging (WAL) file configured with an undersized page size. This mismatch causes SQLite to read uninitialized page-cache memory when executing queries on oversized records, resulting in information disclosure of internal pointers and other database rows."},"relatedVulnerabilities":[{"id":"CVE-2026-119375","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119371","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119371","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"risk":0.10027499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119371","description":"A flaw was found in SQLite. This vulnerability allows an attacker to cause a Denial of Service (DoS) through stack exhaustion. By providing a specially crafted SQL query or an untrusted database file with deeply nested Common Table Expressions (CTEs), an attacker can bypass expression nesting limits. This triggers unbounded recursive function calls during query expansion, causing the application to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-119371","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-30571","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-30571","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-30571","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-30571","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-30571","date":"2026-11-12","epss":0.00194,"percentile":0.09193}],"risk":0.09991000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-30571","description":"A vulnerability was found in libarchive. This issue can cause a race condition in a multi-threaded use of archive_write_disk_header() on posix based systems, which could allow implicit directory creation with permissions 777, without sticky bit, which means any low privileged user on the system can delete and rename files inside those directories."},"relatedVulnerabilities":[{"id":"CVE-2023-30571","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":3.9,"impactScore":2.8,"exploitabilityScore":0.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-30571","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-30571","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-30571","date":"2026-11-12","epss":0.00194,"percentile":0.09193}],"urls":["https://github.com/libarchive/libarchive/issues/1876","https://groups.google.com/g/libarchive-announce"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-30571","description":"Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-11-12","epss":0.00295,"percentile":0.22384}],"risk":0.098825,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6276","description":"A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom `Host:` header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new `Host:` header. This can lead to libcurl incorrectly sending cookies intended for the first host to the second host, resulting in a cookie leak. This issue is categorized as an Origin Validation Error (CWE-346). Exploitation typically requires specific debugging configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-6276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-11-12","epss":0.00295,"percentile":0.22384}],"urls":["https://curl.se/docs/CVE-2026-6276.html","https://curl.se/docs/CVE-2026-6276.json","https://hackerone.com/reports/3671818","http://www.openwall.com/lists/oss-security/2026/04/29/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-6276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-11-12","epss":0.00295,"percentile":0.22384}],"risk":0.098825,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6276","description":"A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom `Host:` header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new `Host:` header. This can lead to libcurl incorrectly sending cookies intended for the first host to the second host, resulting in a cookie leak. This issue is categorized as an Origin Validation Error (CWE-346). Exploitation typically requires specific debugging configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-6276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-11-12","epss":0.00295,"percentile":0.22384}],"urls":["https://curl.se/docs/CVE-2026-6276.html","https://curl.se/docs/CVE-2026-6276.json","https://hackerone.com/reports/3671818","http://www.openwall.com/lists/oss-security/2026/04/29/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32778","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-32778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32778","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32778","date":"2026-11-12","epss":0.00192,"percentile":0.08931}],"risk":0.09696,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32778","description":"A flaw was found in libexpat. This vulnerability allows an attacker to trigger a NULL pointer dereference in the `setContext` function. This occurs when the system attempts to retry an operation after an out-of-memory condition, which can lead to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-32778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32778","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32778","date":"2026-11-12","epss":0.00192,"percentile":0.08931}],"urls":["https://github.com/libexpat/libexpat/pull/1159","https://github.com/libexpat/libexpat/pull/1163","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32778","description":"libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition."}]},{"artifact":{"id":"482a8e4302fffab2","cpes":["cpe:2.3:a:systemd:systemd:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/redhat/systemd@252-79.el9_9?arch=x86_64&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"0:252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"risk":0.096525,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"cfc944a551cf62ec","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@252-79.el9_9?arch=x86_64&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252-79.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"risk":0.096525,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"e3c0176cdb980064","cpes":["cpe:2.3:a:systemd-pam:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/redhat/systemd-pam@252-79.el9_9?arch=x86_64&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252-79.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"risk":0.096525,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"111a276826ed91ad","cpes":["cpe:2.3:a:systemd-rpm-macros:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-rpm-macros:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm_macros:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm_macros:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-rpm:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-rpm:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd-rpm-macros","purl":"pkg:rpm/redhat/systemd-rpm-macros@252-79.el9_9?arch=noarch&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252-79.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"risk":0.096525,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-11-12","epss":0.00165,"percentile":0.05812}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119376","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119376","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"risk":0.09607500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119376","description":"A flaw was found in SQLite. An attacker can cause a Denial of Service (DoS) by supplying specially crafted SQL queries or an untrusted database view containing deeply chained COLLATE operators. This flaw bypasses expression depth limitations, triggering unbounded recursion and stack exhaustion that crashes the application process."},"relatedVulnerabilities":[{"id":"CVE-2026-119376","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56412","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56412","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56412","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56412","date":"2026-11-12","epss":0.00194,"percentile":0.09191}],"risk":0.09603,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56412","description":"A flaw was found in libexpat. This vulnerability, present in versions before 2.8.2, stems from improper handling of XML CDATA sections, where the library fails to adequately track the depth of handler calls. This can result in a 'use-after-free' error, a type of memory corruption that could allow an attacker to crash the application or potentially gain unauthorized control."},"relatedVulnerabilities":[{"id":"CVE-2026-56412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56412","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56412","date":"2026-11-12","epss":0.00194,"percentile":0.09191}],"urls":["https://github.com/libexpat/libexpat/pull/1278","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56412","description":"libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219."}]},{"artifact":{"id":"4c25fee2cfae258c","cpes":["cpe:2.3:a:redhat:glibc:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"0:2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.09413499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"2c72752d878f9ef2","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-290.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.09413499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"d137bf3e614f891e","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.34-290.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.34-290.el9_9:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.34-290.el9_9?arch=x86_64&distro=rhel-9.9&upstream=glibc-2.34-290.el9_9.src.rpm","type":"rpm","version":"2.34-290.el9_9","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.0-or-later AND Unicode-3.0 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.34-290.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glibc","version":"2.34-290.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.09413499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"fce0e99a7fcacb99","cpes":["cpe:2.3:a:libatomic:libatomic:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libatomic:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libatomic","purl":"pkg:rpm/redhat/libatomic@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125709","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-125709","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"risk":0.09384000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-125709","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-125709","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"urls":["https://access.redhat.com/security/cve/CVE-2026-125709","https://bugzilla.redhat.com/show_bug.cgi?id=2569390"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125709","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption."}]},{"artifact":{"id":"121f94a71faca488","cpes":["cpe:2.3:a:libgcc:libgcc:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125709","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-125709","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"risk":0.09384000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-125709","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-125709","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"urls":["https://access.redhat.com/security/cve/CVE-2026-125709","https://bugzilla.redhat.com/show_bug.cgi?id=2569390"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125709","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption."}]},{"artifact":{"id":"de72198654483c11","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:11.5.0-17.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:11.5.0-17.el9_9:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@11.5.0-17.el9_9?arch=x86_64&distro=rhel-9.9&upstream=gcc-11.5.0-17.el9_9.src.rpm","type":"rpm","version":"11.5.0-17.el9_9","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"11.5.0-17.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125709","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gcc","version":"11.5.0-17.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-125709","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"risk":0.09384000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-125709","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-125709","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"urls":["https://access.redhat.com/security/cve/CVE-2026-125709","https://bugzilla.redhat.com/show_bug.cgi?id=2569390"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125709","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption."}]},{"artifact":{"id":"cbdfa30db142aa04","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-9.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-9.el9_8:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-9.el9_8?arch=x86_64&distro=rhel-9.9&upstream=gnutls-3.8.10-9.el9_8.src.rpm","type":"rpm","version":"3.8.10-9.el9_8","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-67693","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gnutls","version":"0:3.8.10-9.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-67693","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-11-12","epss":0.00167,"percentile":0.06004}],"risk":0.09101500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-67693","description":"A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage (KU) and Extended Key Usage (EKU) extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could exploit this flaw by presenting a specially crafted certificate to bypass validation controls, potentially resulting in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-67693","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-11-12","epss":0.00167,"percentile":0.06004}],"urls":["https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/work_items/1642","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://github.com/lkloliver/poc/tree/main/CVE-2026-67693"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15028","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15028","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15028","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-15028","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-15028","date":"2026-11-12","epss":0.00204,"percentile":0.10454}],"risk":0.09078,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15028","description":"A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-15028","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15028","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-15028","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-15028","date":"2026-11-12","epss":0.00204,"percentile":0.10454}],"urls":["https://access.redhat.com/errata/RHSA-2026:38279","https://access.redhat.com/errata/RHSA-2026:69553","https://access.redhat.com/errata/RHSA-2026:79357","https://access.redhat.com/security/cve/CVE-2026-15028","https://bugzilla.redhat.com/show_bug.cgi?id=2497970","https://github.com/libarchive/libarchive/issues/3251","https://github.com/libarchive/libarchive/pull/3253"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15028","description":"A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119591","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119591","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-12","epss":0.00171,"percentile":0.06577}],"risk":0.089775,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119591","description":"A flaw was found in SQLite. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing the host application. By supplying a specially crafted database file or SQL query that performs a count operation over a large multi-row VALUES clause, an attacker can trigger excessive recursion during view optimization. This results in stack exhaustion when freeing internal query expressions, terminating the application process."},"relatedVulnerabilities":[{"id":"CVE-2026-119591","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-12","epss":0.00171,"percentile":0.06577}],"urls":["https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/ab621a3e11ee4acc","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."}]},{"artifact":{"id":"a7a84e78bc72cc28","cpes":["cpe:2.3:a:openldap:openldap:2.6.13-1.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openldap:2.6.13-1.el9:*:*:*:*:*:*:*"],"name":"openldap","purl":"pkg:rpm/redhat/openldap@2.6.13-1.el9?arch=x86_64&distro=rhel-9.9&upstream=openldap-2.6.13-1.el9.src.rpm","type":"rpm","version":"2.6.13-1.el9","language":"","licenses":["OLDAP-2.8"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-22185","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"openldap","version":"0:2.6.13-1.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-22185","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22185","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-22185","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-22185","date":"2026-11-12","epss":0.00152,"percentile":0.04401}],"risk":0.08968,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-22185","description":"A flaw was found in OpenLDAP Lightning Memory-Mapped Database (LMDB) mdb_load. When processing malformed input, a local attacker can exploit a heap buffer underflow vulnerability in the readline() function. This can lead to an out-of-bounds read, potentially causing a denial of service (DoS) and limited disclosure of heap memory contents."},"relatedVulnerabilities":[{"id":"CVE-2026-22185","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22185","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-22185","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-22185","date":"2026-11-12","epss":0.00152,"percentile":0.04401}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=10421","https://seclists.org/fulldisclosure/2026/Jan/5","https://seclists.org/fulldisclosure/2026/Jan/8","https://www.openldap.org/","https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22185","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition."}]},{"artifact":{"id":"e988ae274c693810","cpes":["cpe:2.3:a:redhat:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=rhel-9.9&epoch=2&upstream=tar-1.34-13.el9_8.src.rpm","type":"rpm","version":"2:1.34-13.el9_8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-39804","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"tar","version":"2:1.34-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2023-39804","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39804","date":"2026-11-12","epss":0.00283,"percentile":0.21046}],"risk":0.08914499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-39804","description":"A flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-39804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39804","date":"2026-11-12","epss":0.00283,"percentile":0.21046}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079","https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4","https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723","https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c."}]},{"artifact":{"id":"bb911813b45585f3","cpes":["cpe:2.3:a:perl-AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_AutoLoader:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_AutoLoader:0\\:5.74-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-AutoLoader","purl":"pkg:rpm/redhat/perl-AutoLoader@5.74-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:5.74-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"7e60fe54e6c09824","cpes":["cpe:2.3:a:perl-B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_B:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_B:0\\:1.80-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-B","purl":"pkg:rpm/redhat/perl-B@1.80-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.80-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"006f5e08bfc4c952","cpes":["cpe:2.3:a:perl-Class-Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class-Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class_Struct:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Class:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Class-Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Class_Struct:0\\:0.66-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Class-Struct","purl":"pkg:rpm/redhat/perl-Class-Struct@0.66-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.66-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"2a9a518a53c7512b","cpes":["cpe:2.3:a:perl-Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Errno:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Errno:0\\:1.30-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Errno","purl":"pkg:rpm/redhat/perl-Errno@1.30-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.30-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"f01ef4b3b3b90538","cpes":["cpe:2.3:a:perl-Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Fcntl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Fcntl:0\\:1.13-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Fcntl","purl":"pkg:rpm/redhat/perl-Fcntl@1.13-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.13-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"965edf03abd14e95","cpes":["cpe:2.3:a:perl-File-Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_Basename:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_Basename:0\\:2.85-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-Basename","purl":"pkg:rpm/redhat/perl-File-Basename@2.85-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.85-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"7cb125d521892030","cpes":["cpe:2.3:a:perl-File-stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File-stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File_stat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_File:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-File-stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_File_stat:0\\:1.09-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-File-stat","purl":"pkg:rpm/redhat/perl-File-stat@1.09-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.09-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"67e8889d83c474fb","cpes":["cpe:2.3:a:perl-FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_FileHandle:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_FileHandle:0\\:2.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-FileHandle","purl":"pkg:rpm/redhat/perl-FileHandle@2.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"955cb53aefe39959","cpes":["cpe:2.3:a:perl-Getopt-Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt-Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt_Std:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Getopt:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Getopt-Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Getopt_Std:0\\:1.12-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Getopt-Std","purl":"pkg:rpm/redhat/perl-Getopt-Std@1.12-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.12-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"e824797a395c58fc","cpes":["cpe:2.3:a:perl-IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IO:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IO:0\\:1.43-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IO","purl":"pkg:rpm/redhat/perl-IO@1.43-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.43-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"42816d98549babcf","cpes":["cpe:2.3:a:perl-IPC-Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC-Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC_Open3:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_IPC:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-IPC-Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_IPC_Open3:0\\:1.21-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-IPC-Open3","purl":"pkg:rpm/redhat/perl-IPC-Open3@1.21-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.21-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"7db8a261840c5baa","cpes":["cpe:2.3:a:perl-NDBM-File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM-File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM_File:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_NDBM:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM-File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_NDBM_File:0\\:1.15-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-NDBM_File","purl":"pkg:rpm/redhat/perl-NDBM_File@1.15-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.15-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"4d811d3afb2547c9","cpes":["cpe:2.3:a:perl-POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_POSIX:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_POSIX:0\\:1.94-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-POSIX","purl":"pkg:rpm/redhat/perl-POSIX@1.94-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.94-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"1bc88a0c5a9ab30a","cpes":["cpe:2.3:a:perl-SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_SelectSaver:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_SelectSaver:0\\:1.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-SelectSaver","purl":"pkg:rpm/redhat/perl-SelectSaver@1.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"449e2b4e3fa8b962","cpes":["cpe:2.3:a:perl-Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_Symbol:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_Symbol:0\\:1.08-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-Symbol","purl":"pkg:rpm/redhat/perl-Symbol@1.08-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.08-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"21c1a8a82e4461bf","cpes":["cpe:2.3:a:perl-base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:0\\:2.27-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:rpm/redhat/perl-base@2.27-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:2.27-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"a0ae61863ea1a76d","cpes":["cpe:2.3:a:perl-if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_if:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_if:0\\:0.60.800-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-if","purl":"pkg:rpm/redhat/perl-if@0.60.800-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.60.800-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"4ac7ee895d3c99ec","cpes":["cpe:2.3:a:perl-interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_interpreter:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_interpreter:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-interpreter","purl":"pkg:rpm/redhat/perl-interpreter@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"bf2c1b6ec909c416","cpes":["cpe:2.3:a:perl-libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_libs:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_libs:4\\:5.32.1-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-libs","purl":"pkg:rpm/redhat/perl-libs@5.32.1-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=4&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"4:5.32.1-484.el9_8","language":"","licenses":["(GPL+ or Artistic) and BSD and HSRL and MIT and UCD and Public domain"],"metadata":{"epoch":4,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"8deef1192afd481d","cpes":["cpe:2.3:a:perl-mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_mro:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_mro:0\\:1.23-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-mro","purl":"pkg:rpm/redhat/perl-mro@1.23-484.el9_8?arch=x86_64&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.23-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"9b9db6c4ad38ca1b","cpes":["cpe:2.3:a:perl-overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overload:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overload:0\\:1.31-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overload","purl":"pkg:rpm/redhat/perl-overload@1.31-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.31-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"e12188ce897a6a75","cpes":["cpe:2.3:a:perl-overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_overloading:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_overloading:0\\:0.02-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-overloading","purl":"pkg:rpm/redhat/perl-overloading@0.02-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:0.02-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"103e8134631ed773","cpes":["cpe:2.3:a:perl-subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_subs:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_subs:0\\:1.03-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-subs","purl":"pkg:rpm/redhat/perl-subs@1.03-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.03-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"7a082b0e6a9156ba","cpes":["cpe:2.3:a:perl-vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl-vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl_vars:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_vars:0\\:1.05-484.el9_8:*:*:*:*:*:*:*"],"name":"perl-vars","purl":"pkg:rpm/redhat/perl-vars@1.05-484.el9_8?arch=noarch&distro=rhel-9.9&epoch=0&upstream=perl-5.32.1-484.el9_8.src.rpm","type":"rpm","version":"0:1.05-484.el9_8","language":"","licenses":["GPL+ or Artistic"],"metadata":{"epoch":0,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl","version":"5.32.1-484.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"perl","version":"5.32.1-484.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15534","description":"A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5745","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-5745","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5745","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5745","date":"2026-11-12","epss":0.00167,"percentile":0.06005}],"risk":0.087675,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5745","description":"A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-5745","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5745","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5745","date":"2026-11-12","epss":0.00167,"percentile":0.06005}],"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-5745","https://bugzilla.redhat.com/show_bug.cgi?id=2455921"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5745","description":"A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS)."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56131","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56131","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56131","date":"2026-11-12","epss":0.00183,"percentile":0.07985}],"risk":0.086925,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56131","description":"A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XML_ResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-56131","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56131","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56131","date":"2026-11-12","epss":0.00183,"percentile":0.07985}],"urls":["https://github.com/libexpat/libexpat/pull/1267","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56131","description":"libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation)."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56404","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56404","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56404","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56404","date":"2026-11-12","epss":0.00146,"percentile":0.03924}],"risk":0.08686999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56404","description":"A flaw was found in libexpat. This vulnerability, an integer overflow in the `addBinding` function, could allow a local attacker to execute arbitrary code. By exploiting this, an attacker could gain control over the affected system, compromising its confidentiality and integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-56404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56404","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56404","date":"2026-11-12","epss":0.00146,"percentile":0.03924}],"urls":["https://github.com/libexpat/libexpat/pull/1249","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56404","description":"libexpat before 2.8.2 has an integer overflow in addBinding."}]},{"artifact":{"id":"e988ae274c693810","cpes":["cpe:2.3:a:redhat:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=rhel-9.9&epoch=2&upstream=tar-1.34-13.el9_8.src.rpm","type":"rpm","version":"2:1.34-13.el9_8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53655","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"tar","version":"2:1.34-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-53655","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53655","date":"2026-11-12","epss":0.00156,"percentile":0.04858}],"risk":0.08657999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53655","description":"A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to other standard tar implementations. A remote attacker could exploit this by crafting a malicious archive, causing different interpretations of archive contents between node-tar and other tools. This could allow an attacker to hide malicious files or sensitive information from security scanners that rely on different tar parsing libraries, potentially leading to information disclosure or bypassing security controls."},"relatedVulnerabilities":[{"id":"CVE-2026-53655","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53655","date":"2026-11-12","epss":0.00156,"percentile":0.04858}],"urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16."}]},{"artifact":{"id":"482a8e4302fffab2","cpes":["cpe:2.3:a:systemd:systemd:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/redhat/systemd@252-79.el9_9?arch=x86_64&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"0:252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"risk":0.085575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"cfc944a551cf62ec","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@252-79.el9_9?arch=x86_64&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252-79.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"risk":0.085575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"e3c0176cdb980064","cpes":["cpe:2.3:a:systemd-pam:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-pam:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_pam:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/redhat/systemd-pam@252-79.el9_9?arch=x86_64&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252-79.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"risk":0.085575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"111a276826ed91ad","cpes":["cpe:2.3:a:systemd-rpm-macros:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-rpm-macros:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm_macros:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm_macros:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-rpm:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd-rpm:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd_rpm:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-rpm-macros:252-79.el9_9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_rpm_macros:252-79.el9_9:*:*:*:*:*:*:*"],"name":"systemd-rpm-macros","purl":"pkg:rpm/redhat/systemd-rpm-macros@252-79.el9_9?arch=noarch&distro=rhel-9.9&upstream=systemd-252-79.el9_9.src.rpm","type":"rpm","version":"252-79.el9_9","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252-79.el9_9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"systemd","version":"252-79.el9_9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"risk":0.085575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-11-12","epss":0.00163,"percentile":0.05548}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"987c8daac6c0f9f4","cpes":["cpe:2.3:a:libsolv:libsolv:0.7.24-6.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsolv:0.7.24-6.el9_8:*:*:*:*:*:*:*"],"name":"libsolv","purl":"pkg:rpm/redhat/libsolv@0.7.24-6.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libsolv-0.7.24-6.el9_8.src.rpm","type":"rpm","version":"0.7.24-6.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82327","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libsolv","version":"0:0.7.24-6.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-82327","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82327","cwe":"CWE-129","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-82327","date":"2026-11-12","epss":0.00163,"percentile":0.05521}],"risk":0.085575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82327","description":"A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value."},"relatedVulnerabilities":[{"id":"CVE-2026-82327","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82327","cwe":"CWE-129","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-82327","date":"2026-11-12","epss":0.00163,"percentile":0.05521}],"urls":["https://access.redhat.com/security/cve/CVE-2026-82327","https://bugzilla.redhat.com/show_bug.cgi?id=2525602"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82327","description":"A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50812","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-50812","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-11-12","epss":0.0016,"percentile":0.05238}],"risk":0.084,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-50812","description":"A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-50812","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-11-12","epss":0.0016,"percentile":0.05238}],"urls":["https://gist.github.com/junius-sec/bb556f333957c5226dede314db0e9e91","https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb1383549f2a18aa35508385d","https://sqlite.org/src/info/e807d4e3798efd53"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50812","description":"A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5916","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-5916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5916","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5916","date":"2026-11-12","epss":0.00237,"percentile":0.14872}],"risk":0.08176499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5916","description":"A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0."},"relatedVulnerabilities":[{"id":"CVE-2025-5916","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5916","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5916","date":"2026-11-12","epss":0.00237,"percentile":0.14872}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5916","https://bugzilla.redhat.com/show_bug.cgi?id=2370872","https://github.com/libarchive/libarchive/pull/2568","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5916","description":"A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0."}]},{"artifact":{"id":"58e822e367013732","cpes":["cpe:2.3:a:redhat:sed:4.8-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:sed:sed:4.8-10.el9:*:*:*:*:*:*:*"],"name":"sed","purl":"pkg:rpm/redhat/sed@4.8-10.el9?arch=x86_64&distro=rhel-9.9&upstream=sed-4.8-10.el9.src.rpm","type":"rpm","version":"4.8-10.el9","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5958","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sed","version":"0:4.8-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-5958","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-11-12","epss":0.00142,"percentile":0.03575}],"risk":0.08023,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5958","description":"A Time-of-Check Time-of-Use (TOCTOU) race condition was found in GNU sed. When the -i (in-place) and --follow-symlinks options are used together, sed resolves the symlink but reopens the path for writing. An attacker with write access to the directory containing the symlink can swap it between the check and the open operations. If a privileged user executes sed in this manner on a path influenced by the attacker, it can lead to arbitrary file overwrites and potential privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-5958","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-11-12","epss":0.00142,"percentile":0.03575}],"urls":["https://cert.pl/en/posts/2026/04/CVE-2026-5958","https://www.gnu.org/software/sed/","http://www.openwall.com/lists/oss-security/2026/05/13/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5958","description":"When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores the resolved path for determining when output is written,\n2. opens the original symlink path (not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10."}]},{"artifact":{"id":"3b95a370d9cbeb72","cpes":["cpe:2.3:a:redhat:zlib:1.2.11-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:zlib:zlib:1.2.11-40.el9:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=rhel-9.9&upstream=zlib-1.2.11-40.el9.src.rpm","type":"rpm","version":"1.2.11-40.el9","language":"","licenses":["zlib and Boost"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-27171","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"zlib","version":"0:1.2.11-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27171","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-11-12","epss":0.00248,"percentile":0.1622}],"risk":0.07812,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27171","description":"A flaw was found in zlib. An attacker providing specially crafted input to the `crc32_combine64` or `crc32_combine_gen64` functions could trigger an infinite loop within the `x2nmodp` function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-27171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-11-12","epss":0.00248,"percentile":0.1622}],"urls":["https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/","https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf","https://github.com/madler/zlib/issues/904","https://github.com/madler/zlib/releases/tag/v1.3.2","https://ostif.org/zlib-audit-complete/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119372","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119372","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"risk":0.077175,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119372","description":"A flaw was found in SQLite. A use-after-free vulnerability exists in its full-text search extension due to improper handling of cached memory pointers during query processing. An attacker can exploit this issue by executing a specially crafted full-text search query, causing the application to access previously freed memory and crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-119372","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."}]},{"artifact":{"id":"6662ec52047e3264","cpes":["cpe:2.3:a:libblkid:libblkid:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.37.4-28.el9_9.1:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.37.4-28.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=util-linux-2.37.4-28.el9_9.1.src.rpm","type":"rpm","version":"2.37.4-28.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.37.4-28.el9_9.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"util-linux","version":"2.37.4-28.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"risk":0.076145,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"86d8e0ce15462ab7","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.37.4-28.el9_9.1:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.37.4-28.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=util-linux-2.37.4-28.el9_9.1.src.rpm","type":"rpm","version":"2.37.4-28.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.37.4-28.el9_9.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"util-linux","version":"2.37.4-28.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"risk":0.076145,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"49fc9eca75f4bb08","cpes":["cpe:2.3:a:libmount:libmount:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.37.4-28.el9_9.1:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.37.4-28.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=util-linux-2.37.4-28.el9_9.1.src.rpm","type":"rpm","version":"2.37.4-28.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.37.4-28.el9_9.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"util-linux","version":"2.37.4-28.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"risk":0.076145,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"ad54a8c53e5c1eff","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.37.4-28.el9_9.1:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.37.4-28.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=util-linux-2.37.4-28.el9_9.1.src.rpm","type":"rpm","version":"2.37.4-28.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.37.4-28.el9_9.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"util-linux","version":"2.37.4-28.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"risk":0.076145,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"584b72581aeab377","cpes":["cpe:2.3:a:libuuid:libuuid:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.37.4-28.el9_9.1:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.37.4-28.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=util-linux-2.37.4-28.el9_9.1.src.rpm","type":"rpm","version":"2.37.4-28.el9_9.1","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.37.4-28.el9_9.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"util-linux","version":"2.37.4-28.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"risk":0.076145,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"01166fefada970d7","cpes":["cpe:2.3:a:util-linux:util-linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.37.4-28.el9_9.1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.37.4-28.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=util-linux-2.37.4-28.el9_9.1.src.rpm","type":"rpm","version":"2.37.4-28.el9_9.1","language":"","licenses":["GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"util-linux","version":"0:2.37.4-28.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"risk":0.076145,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"caa6f62c6929189c","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.37.4-28.el9_9.1:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.37.4-28.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=util-linux-2.37.4-28.el9_9.1.src.rpm","type":"rpm","version":"2.37.4-28.el9_9.1","language":"","licenses":["GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.37.4-28.el9_9.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"util-linux","version":"2.37.4-28.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"risk":0.076145,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-11-12","epss":0.00157,"percentile":0.04932}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"6b29b8ef2f83cc22","cpes":["cpe:2.3:a:redhat:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"0:4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-11-12","epss":0.00178,"percentile":0.07501}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-11-12","epss":0.00178,"percentile":0.07501}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"108e4bcd5f0cf305","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-40.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-11-12","epss":0.00178,"percentile":0.07501}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-11-12","epss":0.00178,"percentile":0.07501}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"9f0167f09ad501fe","cpes":["cpe:2.3:a:policycoreutils:policycoreutils:3.6-9.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:policycoreutils:3.6-9.el9:*:*:*:*:*:*:*"],"name":"policycoreutils","purl":"pkg:rpm/redhat/policycoreutils@3.6-9.el9?arch=x86_64&distro=rhel-9.9&upstream=policycoreutils-3.6-9.el9.src.rpm","type":"rpm","version":"3.6-9.el9","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59677","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"policycoreutils","version":"0:3.6-9.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-59677","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59677","cwe":"CWE-862","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-59677","date":"2026-11-12","epss":0.0014,"percentile":0.03383}],"risk":0.0735,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59677","description":"A flaw was found in policycoreutils through 3.10 in seunshares. Missing authorization lets a local user in an unconfined SELinux context terminate other processes that are also unconfined, including root-owned ones. That can cause denial of service by killing critical processes."},"relatedVulnerabilities":[{"id":"CVE-2026-59677","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59677","cwe":"CWE-862","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-59677","date":"2026-11-12","epss":0.0014,"percentile":0.03383}],"urls":["https://bugzilla.suse.com/show_bug.cgi?id=1268256","https://security.opensuse.org/2026/07/15/selinux-seunshare.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59677","description":"A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in\nunconfined context\n\n\n\n\n\n\nThis issue affects policycoreutils through 3.10."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5917","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-5917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5917","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5917","date":"2026-11-12","epss":0.00253,"percentile":0.16919}],"risk":0.07337,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5917","description":"A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0."},"relatedVulnerabilities":[{"id":"CVE-2025-5917","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5917","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5917","date":"2026-11-12","epss":0.00253,"percentile":0.16919}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5917","https://bugzilla.redhat.com/show_bug.cgi?id=2370874","https://github.com/libarchive/libarchive/pull/2588","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5917","description":"A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0."}]},{"artifact":{"id":"3aa5685c6c6515ea","cpes":["cpe:2.3:a:coreutils-single:coreutils-single:8.32-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-single:coreutils_single:8.32-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_single:coreutils-single:8.32-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_single:coreutils_single:8.32-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-single:8.32-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_single:8.32-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:coreutils-single:8.32-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:coreutils_single:8.32-43.el9:*:*:*:*:*:*:*"],"name":"coreutils-single","purl":"pkg:rpm/redhat/coreutils-single@8.32-43.el9?arch=x86_64&distro=rhel-9.9&upstream=coreutils-8.32-43.el9.src.rpm","type":"rpm","version":"8.32-43.el9","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils","version":"8.32-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56391","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"coreutils","version":"8.32-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.07270499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56391","description":"A flaw was found in GNU coreutils uniq. When processing specially crafted multibyte input with the --check-chars option, an attacker can trigger an out-of-bounds read. This vulnerability can lead to a denial of service (DoS) due to an application crash and potentially expose sensitive information from adjacent memory."},"relatedVulnerabilities":[{"id":"CVE-2026-56391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86469","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-86469","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-11-12","epss":0.00141,"percentile":0.03479}],"risk":0.07261500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."},"relatedVulnerabilities":[{"id":"CVE-2026-86469","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-11-12","epss":0.00141,"percentile":0.03479}],"urls":["https://access.redhat.com/security/cve/CVE-2026-86469","https://bugzilla.redhat.com/show_bug.cgi?id=2473839","https://gitlab.gnome.org/GNOME/glib/-/blob/main/gio/glocalfileoutputstream.c","https://gitlab.gnome.org/GNOME/glib/-/work_items/4044"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."}]},{"artifact":{"id":"38f70d6bae6b19d1","cpes":["cpe:2.3:a:libgcrypt:libgcrypt:1.10.0-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcrypt:1.10.0-13.el9_8:*:*:*:*:*:*:*"],"name":"libgcrypt","purl":"pkg:rpm/redhat/libgcrypt@1.10.0-13.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libgcrypt-1.10.0-13.el9_8.src.rpm","type":"rpm","version":"1.10.0-13.el9_8","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libgcrypt","version":"0:1.10.0-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-41990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.3,"impactScore":2.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41990","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41990","date":"2026-11-12","epss":0.00229,"percentile":0.13813}],"risk":0.07213499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41990","description":"A flaw was found in Libgcrypt. During Dilithium signing operations, the library fails to perform a bounds check when writing to a static array. While the data involved is not directly controlled by an attacker, this vulnerability could lead to memory corruption, potentially resulting in a denial of service (DoS) or affecting data integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-41990","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41990","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41990","date":"2026-11-12","epss":0.00229,"percentile":0.13813}],"urls":["https://dev.gnupg.org/T8208","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html","https://www.openwall.com/lists/oss-security/2026/04/21/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41990","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data."}]},{"artifact":{"id":"6b29b8ef2f83cc22","cpes":["cpe:2.3:a:redhat:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"0:4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"6b29b8ef2f83cc22","cpes":["cpe:2.3:a:redhat:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"0:4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"108e4bcd5f0cf305","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-40.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"108e4bcd5f0cf305","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-40.el9:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-40.el9:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.16.1.3-40.el9?arch=x86_64&distro=rhel-9.9&upstream=rpm-4.16.1.3-40.el9.src.rpm","type":"rpm","version":"4.16.1.3-40.el9","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-40.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"rpm","version":"4.16.1.3-40.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-11-12","epss":0.00119,"percentile":0.01808}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"242306ad7b0927ba","cpes":["cpe:2.3:a:redhat:pam:1.5.1-29.el9:*:*:*:*:*:*:*","cpe:2.3:a:pam:pam:1.5.1-29.el9:*:*:*:*:*:*:*"],"name":"pam","purl":"pkg:rpm/redhat/pam@1.5.1-29.el9?arch=x86_64&distro=rhel-9.9&upstream=pam-1.5.1-29.el9.src.rpm","type":"rpm","version":"1.5.1-29.el9","language":"","licenses":["BSD and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12610","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"pam","version":"0:1.5.1-29.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-12610","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-11-12","epss":0.00123,"percentile":0.02089}],"risk":0.07011,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."},"relatedVulnerabilities":[{"id":"CVE-2026-12610","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-11-12","epss":0.00123,"percentile":0.02089}],"urls":["https://access.redhat.com/errata/RHSA-2026:97077","https://access.redhat.com/security/cve/CVE-2026-12610","https://bugzilla.redhat.com/show_bug.cgi?id=2490288","https://github.com/SSSD/sssd/issues/8796"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56405","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-56405","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56405","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56405","date":"2026-11-12","epss":0.00141,"percentile":0.03457}],"risk":0.069795,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56405","description":"A flaw was found in libexpat. An integer overflow vulnerability exists within the `getAttributeId` function. This flaw could allow an attacker to potentially disclose sensitive information or execute arbitrary code, leading to a compromise of the system's integrity and confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2026-56405","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56405","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56405","date":"2026-11-12","epss":0.00141,"percentile":0.03457}],"urls":["https://github.com/libexpat/libexpat/pull/1251","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56405","description":"libexpat before 2.8.2 has an integer overflow in getAttributeId."}]},{"artifact":{"id":"4895d296435091d5","cpes":["cpe:2.3:a:redhat:dbus:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus:1\\:1.12.20-10.el9:*:*:*:*:*:*:*"],"name":"dbus","purl":"pkg:rpm/redhat/dbus@1.12.20-10.el9?arch=x86_64&distro=rhel-9.9&epoch=1&upstream=dbus-1.12.20-10.el9.src.rpm","type":"rpm","version":"1:1.12.20-10.el9","language":"","licenses":["(GPLv2+ or AFL) and GPLv2+"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-120749","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"dbus","version":"1:1.12.20-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-120749","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120749","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120749","date":"2026-11-12","epss":0.00124,"percentile":0.02193}],"risk":0.06944,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-120749","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon."},"relatedVulnerabilities":[{"id":"CVE-2026-120749","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120749","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120749","date":"2026-11-12","epss":0.00124,"percentile":0.02193}],"urls":["https://access.redhat.com/security/cve/CVE-2026-120749","https://bugzilla.redhat.com/show_bug.cgi?id=2567978","https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565","https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592","https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120749","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon."}]},{"artifact":{"id":"c22002d40df2a9cb","cpes":["cpe:2.3:a:dbus-common:dbus-common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:dbus-common:dbus_common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:dbus_common:dbus-common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:dbus_common:dbus_common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus-common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus_common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus-common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus_common:1\\:1.12.20-10.el9:*:*:*:*:*:*:*"],"name":"dbus-common","purl":"pkg:rpm/redhat/dbus-common@1.12.20-10.el9?arch=noarch&distro=rhel-9.9&epoch=1&upstream=dbus-1.12.20-10.el9.src.rpm","type":"rpm","version":"1:1.12.20-10.el9","language":"","licenses":["(GPLv2+ or AFL) and GPLv2+"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"dbus","version":"1.12.20-10.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120749","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"dbus","version":"1.12.20-10.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-120749","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120749","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120749","date":"2026-11-12","epss":0.00124,"percentile":0.02193}],"risk":0.06944,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-120749","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon."},"relatedVulnerabilities":[{"id":"CVE-2026-120749","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120749","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120749","date":"2026-11-12","epss":0.00124,"percentile":0.02193}],"urls":["https://access.redhat.com/security/cve/CVE-2026-120749","https://bugzilla.redhat.com/show_bug.cgi?id=2567978","https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565","https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592","https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120749","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon."}]},{"artifact":{"id":"e988ae274c693810","cpes":["cpe:2.3:a:redhat:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.34-13.el9_8:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=rhel-9.9&epoch=2&upstream=tar-1.34-13.el9_8.src.rpm","type":"rpm","version":"2:1.34-13.el9_8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-64118","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"tar","version":"2:1.34-13.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-64118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64118","cwe":"CWE-362","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-64118","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64118","date":"2026-11-12","epss":0.00134,"percentile":0.02987}],"risk":0.06499,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-64118","description":"A flaw was found in node-tar, a Tar utility for Node.js. This vulnerability allows a local attacker to potentially disclose sensitive information. When the .t (or .list) function is used with { sync: true } to read tar entry contents, and the tar file is concurrently modified on disk to a smaller size, the function may return uninitialized memory contents. This could lead to the exposure of arbitrary data."},"relatedVulnerabilities":[{"id":"CVE-2025-64118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64118","cwe":"CWE-362","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-64118","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64118","date":"2026-11-12","epss":0.00134,"percentile":0.02987}],"urls":["https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d","https://github.com/isaacs/node-tar/issues/445","https://github.com/isaacs/node-tar/pull/446","https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64118","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-66382","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-66382","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-11-12","epss":0.00217,"percentile":0.12326}],"risk":0.064015,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-66382","description":"A flaw was found in libexpat. This vulnerability allows a denial of service (DoS) by processing a crafted file with an approximate size of 2 MiB, leading to dozens of seconds of processing time."},"relatedVulnerabilities":[{"id":"CVE-2025-66382","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-11-12","epss":0.00217,"percentile":0.12326}],"urls":["https://github.com/libexpat/libexpat/issues/1076","http://www.openwall.com/lists/oss-security/2025/12/02/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66382","description":"In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time."}]},{"artifact":{"id":"6c6ff44b2d10b255","cpes":["cpe:2.3:a:bzip2-libs:bzip2-libs:1.0.8-11.el9:*:*:*:*:*:*:*","cpe:2.3:a:bzip2-libs:bzip2_libs:1.0.8-11.el9:*:*:*:*:*:*:*","cpe:2.3:a:bzip2_libs:bzip2-libs:1.0.8-11.el9:*:*:*:*:*:*:*","cpe:2.3:a:bzip2_libs:bzip2_libs:1.0.8-11.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bzip2-libs:1.0.8-11.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bzip2_libs:1.0.8-11.el9:*:*:*:*:*:*:*","cpe:2.3:a:bzip2:bzip2-libs:1.0.8-11.el9:*:*:*:*:*:*:*","cpe:2.3:a:bzip2:bzip2_libs:1.0.8-11.el9:*:*:*:*:*:*:*"],"name":"bzip2-libs","purl":"pkg:rpm/redhat/bzip2-libs@1.0.8-11.el9?arch=x86_64&distro=rhel-9.9&upstream=bzip2-1.0.8-11.el9.src.rpm","type":"rpm","version":"1.0.8-11.el9","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bzip2","version":"1.0.8-11.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42250","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"bzip2","version":"1.0.8-11.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-42250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-11-12","epss":0.00126,"percentile":0.02361}],"risk":0.063,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42250","description":"A flaw was found in bzip2. The bzip2recover utility contains an off-by-one error that allows a local attacker to cause an out-of-bounds write to a global buffer by processing a specially crafted file. This memory corruption can lead to a crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-42250","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-11-12","epss":0.00126,"percentile":0.02361}],"urls":["https://cert.pl/en/posts/2026/05/CVE-2026-42250/","https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/","https://sourceware.org/bzip2/","https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"}]},{"artifact":{"id":"965c5108ab84fcf4","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=rhel-9.9&upstream=gnupg2-2.3.3-5.el9_7.src.rpm","type":"rpm","version":"2.3.3-5.el9_7","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-68972","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gnupg2","version":"0:2.3.3-5.el9_7"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-68972","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68972","cwe":"CWE-347","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-68972","date":"2026-11-12","epss":0.00113,"percentile":0.0146}],"risk":0.061585,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-68972","description":"A flaw was found in GnuPG. An adversary can exploit this vulnerability by crafting a signed message that includes a form feed character (\\f) at the end of a plaintext line. This allows the adversary to append additional, unsigned text to the message while the signature verification still reports success. This issue leads to an integrity bypass, potentially enabling the spoofing of signed communications."},"relatedVulnerabilities":[{"id":"CVE-2025-68972","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68972","cwe":"CWE-347","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-68972","date":"2026-11-12","epss":0.00113,"percentile":0.0146}],"urls":["https://gpg.fail/formfeed","https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i","https://news.ycombinator.com/item?id=46404339"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24515","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-24515","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24515","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24515","date":"2026-11-12","epss":0.00201,"percentile":0.10106}],"risk":0.059294999999999994,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-24515","description":"A null pointer dereference flaw has been discovered in libexpat. The function `XML_ExternalEntityParserCreate` failed to copy the encoding handler data passed to XML_SetUnknownEncodingHandler from the parent to the new subparser. This can cause a NULL dereference from external entities that declare use of an unknown encoding. The expected impact is denial of service. It takes use of both functions `XML_ExternalEntityParserCreate` and `XML_SetUnknownEncodingHandler` for an application to be vulnerable."},"relatedVulnerabilities":[{"id":"CVE-2026-24515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24515","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24515","date":"2026-11-12","epss":0.00201,"percentile":0.10106}],"urls":["https://github.com/libexpat/libexpat/pull/1131","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24515","description":"In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data."}]},{"artifact":{"id":"372d50de6872bbfb","cpes":["cpe:2.3:a:redhat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-9.el9_9.4:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-9.el9_9.4?arch=x86_64&distro=rhel-9.9&upstream=expat-2.5.0-9.el9_9.4.src.rpm","type":"rpm","version":"2.5.0-9.el9_9.4","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76957","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"expat","version":"0:2.5.0-9.el9_9.4"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-76957","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76957","date":"2026-11-12","epss":0.00119,"percentile":0.01789}],"risk":0.058905000000000006,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76957","description":"A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-76957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76957","date":"2026-11-12","epss":0.00119,"percentile":0.01789}],"urls":["https://github.com/libexpat/libexpat/pull/1322","https://github.com/libexpat/libexpat/pull/1329","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76957","description":"libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412."}]},{"artifact":{"id":"e07d8d180917fe5b","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/redhat/curl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14017","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-14017","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-11-12","epss":0.00114,"percentile":0.01498}],"risk":0.05585999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14017","description":"A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed."},"relatedVulnerabilities":[{"id":"CVE-2025-14017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-11-12","epss":0.00114,"percentile":0.01498}],"urls":["https://curl.se/docs/CVE-2025-14017.html","https://curl.se/docs/CVE-2025-14017.json","http://www.openwall.com/lists/oss-security/2026/01/07/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","description":"When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."}]},{"artifact":{"id":"bb5ee8da04d715d6","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:7.76.1-43.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:7.76.1-43.el9:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@7.76.1-43.el9?arch=x86_64&distro=rhel-9.9&upstream=curl-7.76.1-43.el9.src.rpm","type":"rpm","version":"7.76.1-43.el9","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.76.1-43.el9"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14017","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"curl","version":"7.76.1-43.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-14017","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-11-12","epss":0.00114,"percentile":0.01498}],"risk":0.05585999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14017","description":"A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed."},"relatedVulnerabilities":[{"id":"CVE-2025-14017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-11-12","epss":0.00114,"percentile":0.01498}],"urls":["https://curl.se/docs/CVE-2025-14017.html","https://curl.se/docs/CVE-2025-14017.json","http://www.openwall.com/lists/oss-security/2026/01/07/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","description":"When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."}]},{"artifact":{"id":"965c5108ab84fcf4","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=rhel-9.9&upstream=gnupg2-2.3.3-5.el9_7.src.rpm","type":"rpm","version":"2.3.3-5.el9_7","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-30258","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gnupg2","version":"0:2.3.3-5.el9_7"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2025-30258","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-30258","cwe":"CWE-754","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-30258","date":"2026-11-12","epss":0.00194,"percentile":0.09224}],"risk":0.055290000000000006,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-30258","description":"A flaw was found in GnuPG. In affected versions, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, leading to a verification denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-30258","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-30258","cwe":"CWE-754","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-30258","date":"2026-11-12","epss":0.00194,"percentile":0.09224}],"urls":["https://dev.gnupg.org/T7527","https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158","https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30258","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\""}]},{"artifact":{"id":"9f0167f09ad501fe","cpes":["cpe:2.3:a:policycoreutils:policycoreutils:3.6-9.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:policycoreutils:3.6-9.el9:*:*:*:*:*:*:*"],"name":"policycoreutils","purl":"pkg:rpm/redhat/policycoreutils@3.6-9.el9?arch=x86_64&distro=rhel-9.9&upstream=policycoreutils-3.6-9.el9.src.rpm","type":"rpm","version":"3.6-9.el9","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59676","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"policycoreutils","version":"0:3.6-9.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-59676","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59676","cwe":"CWE-367","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-59676","date":"2026-11-12","epss":0.00101,"percentile":0.00882}],"risk":0.052015000000000006,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59676","description":"A flaw was found in policycoreutils through 3.10 in seunshare. A TOCTOU race lets a local user running in an unconfined SELinux domain delete arbitrary root-owned files. Removing critical system files can cause denial of service; integrity impact is limited to unauthorized deletion."},"relatedVulnerabilities":[{"id":"CVE-2026-59676","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59676","cwe":"CWE-367","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-59676","date":"2026-11-12","epss":0.00101,"percentile":0.00882}],"urls":["https://bugzilla.suse.com/show_bug.cgi?id=1268256","https://security.opensuse.org/2026/07/15/selinux-seunshare.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59676","description":"A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files,\n\n\n\n\n\n\nThis issue affects policycoreutils through 3.10."}]},{"artifact":{"id":"e1b413eca8446714","cpes":["cpe:2.3:a:libarchive:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.5.3-11.el9_8:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.5.3-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=libarchive-3.5.3-11.el9_8.src.rpm","type":"rpm","version":"3.5.3-11.el9_8","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17591","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"libarchive","version":"0:3.5.3-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-17591","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17591","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-17591","date":"2026-11-12","epss":0.00154,"percentile":0.04547}],"risk":0.05081999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-17591","description":"A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data."},"relatedVulnerabilities":[{"id":"CVE-2026-17591","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17591","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-17591","date":"2026-11-12","epss":0.00154,"percentile":0.04547}],"urls":["https://access.redhat.com/errata/RHSA-2026:77775","https://access.redhat.com/security/cve/CVE-2026-17591","https://bugzilla.redhat.com/show_bug.cgi?id=2554209","https://github.com/libarchive/libarchive/pull/3318"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17591","description":"A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data."}]},{"artifact":{"id":"9f0167f09ad501fe","cpes":["cpe:2.3:a:policycoreutils:policycoreutils:3.6-9.el9:*:*:*:*:*:*:*","cpe:2.3:a:redhat:policycoreutils:3.6-9.el9:*:*:*:*:*:*:*"],"name":"policycoreutils","purl":"pkg:rpm/redhat/policycoreutils@3.6-9.el9?arch=x86_64&distro=rhel-9.9&upstream=policycoreutils-3.6-9.el9.src.rpm","type":"rpm","version":"3.6-9.el9","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"policycoreutils","version":"0:3.6-9.el9"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-19079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19079","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-19079","date":"2026-11-12","epss":0.00106,"percentile":0.0112}],"risk":0.049819999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19079","description":"A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow."},"relatedVulnerabilities":[{"id":"CVE-2026-19079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19079","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-19079","date":"2026-11-12","epss":0.00106,"percentile":0.0112}],"urls":["https://access.redhat.com/errata/RHSA-2026:51861","https://access.redhat.com/security/cve/CVE-2026-19079","https://bugzilla.redhat.com/show_bug.cgi?id=2511976","https://github.com/SELinuxProject/selinux/commit/a556538c2d5d2583273e025b45c02651fef47679"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19079","description":"A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow."}]},{"artifact":{"id":"4e6e27102216dd33","cpes":["cpe:2.3:a:redhat:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.68.4-29.el9_9.1:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.68.4-29.el9_9.1?arch=x86_64&distro=rhel-9.9&upstream=glib2-2.68.4-29.el9_9.1.src.rpm","type":"rpm","version":"2.68.4-29.el9_9.1","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1485","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"glib2","version":"0:2.68.4-29.el9_9.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-1485","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1485","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1485","date":"2026-11-12","epss":0.00156,"percentile":0.04812}],"risk":0.045239999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1485","description":"A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-1485","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1485","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1485","date":"2026-11-12","epss":0.00156,"percentile":0.04812}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1485","https://bugzilla.redhat.com/show_bug.cgi?id=2433325","https://gitlab.gnome.org/GNOME/glib/-/issues/3871"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1485","description":"A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability."}]},{"artifact":{"id":"965c5108ab84fcf4","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.3.3-5.el9_7:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=rhel-9.9&upstream=gnupg2-2.3.3-5.el9_7.src.rpm","type":"rpm","version":"2.3.3-5.el9_7","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57062","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"gnupg2","version":"0:2.3.3-5.el9_7"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-57062","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57062","cwe":"CWE-1284","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-57062","date":"2026-11-12","epss":0.00142,"percentile":0.03627}],"risk":0.04189,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57062","description":"A flaw in GnuPG's gpgsm component improperly handles the Cryptographic Message Syntax (CMS) format for AES-GCM. By accepting an authentication tag length of 4 bytes instead of the required 12 bytes, this vulnerability allows for a low-impact data integrity issue where the cryptographic validity of messages could be compromised."},"relatedVulnerabilities":[{"id":"CVE-2026-57062","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57062","cwe":"CWE-1284","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-57062","date":"2026-11-12","epss":0.00142,"percentile":0.03627}],"urls":["https://blog.calif.io/p/how-to-format-a-ciphertext","https://www.gnupg.org/download/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57062","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182."}]},{"artifact":{"id":"1c9a349fe96f859f","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.34.1-11.el9_8:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.34.1-11.el9_8:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=rhel-9.9&upstream=sqlite-3.34.1-11.el9_8.src.rpm","type":"rpm","version":"3.34.1-11.el9_8","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.34.1-11.el9_8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119377","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"sqlite","version":"3.34.1-11.el9_8"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-119377","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"risk":0.035475000000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:9","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119377","description":"A flaw was found in SQLite. When processing queries that use a RIGHT or FULL JOIN with a USING clause, SQLite fails to validate authorization restrictions on all joined tables. An attacker capable of submitting SQL queries can exploit this flaw to bypass access control restrictions and read protected column data."},"relatedVulnerabilities":[{"id":"CVE-2026-119377","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107364","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-107364","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107364","description":"In all released versions of MIT krb5, an unauthenticated attacker can cause a KDC process to perform a large read overrun, likely causing the process to terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-107364","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118380","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-118380","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-118380","description":"In MIT krb5 release 1.4 and later, an active network attacker can alter the arguments sent by a legitimate client to RPC services protected by RPCSEC_GSS, or cause return values to be sent in plain text."},"relatedVulnerabilities":[{"id":"CVE-2026-118380","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71199","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-71199","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-71199","description":"In MIT krb5 release 1.14 and later (since authentication indicator support was added), an authenticated attacker can bypass authentication indicator requirements using an unkeyed checksum in the CAMMAC authdata container."},"relatedVulnerabilities":[{"id":"CVE-2026-71199","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71200","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-71200","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-71200","description":"If a KDC is configured to allow PKINIT authentication, an unauthenticated attacker can trigger a null pointer dereference, causing the process to terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-71200","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107884","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-107884","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.7,"impactScore":5.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107884","description":"In MIT krb5 release 1.15 and later, a client with kadmin administrative privileges can bypass the lockdown_keys attribute by using the password change protocol instead of the kadmin protocol."},"relatedVulnerabilities":[{"id":"CVE-2026-107884","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a4d81b439793fef9","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.1-10.el9_8.1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8.1?arch=x86_64&distro=rhel-9.9&upstream=krb5-1.21.1-10.el9_8.1.src.rpm","type":"rpm","version":"1.21.1-10.el9_8.1","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:beebeb2161cf46d3f6fd75c9687831274d8220853c7d2bac9b6f3ad83849e4de","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.1-10.el9_8.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.21.1-10.el9_9.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111423","versionConstraint":"< 0:1.21.1-10.el9_9.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"9.9"},"package":{"name":"krb5","version":"1.21.1-10.el9_8.1"},"namespace":"redhat:distro:redhat:9"}}],"vulnerability":{"id":"CVE-2026-111423","fix":{"state":"fixed","versions":["0:1.21.1-10.el9_9.2"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"0:1.21.1-10.el9_9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:9","advisories":[{"id":"RHSA-2026:99715","link":"https://access.redhat.com/errata/RHSA-2026:99715"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-111423","description":"In MIT krb5 release 1.21 and later, server applications will erroneously treat the PAC within a ticket as verified when the server checksum is invalid."},"relatedVulnerabilities":[{"id":"CVE-2026-111423","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T06:54:18.240Z","grype_db_version":"2026-11-13T15:40:34.000Z"}