{"grype_matches":[{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-09","epss":0.17301,"percentile":0.97042}],"risk":7.179915,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-09","epss":0.17301,"percentile":0.97042}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-09","epss":0.17301,"percentile":0.97042}],"risk":7.179915,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-09","epss":0.17301,"percentile":0.97042}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2005-2541","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2005-2541","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-09","epss":0.03992,"percentile":0.90261}],"risk":2.3951999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2005-2541","description":"A flaw was found in tar utility that can allow the root user to extract files with preserved setuid and setgid permissions without any warning. This behavior can lead to the creation of malicious setuid executables owned by root from a crafted tar file, posing significant security risks."},"relatedVulnerabilities":[{"id":"CVE-2005-2541","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-09","epss":0.03992,"percentile":0.90261}],"urls":["http://marc.info/?l=bugtraq&m=112327628230258&w=2","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-09","epss":0.01199,"percentile":0.67256}],"risk":0.76736,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-09","epss":0.01199,"percentile":0.67256}],"urls":["https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-09","epss":0.01199,"percentile":0.67256}],"risk":0.76736,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-09","epss":0.01199,"percentile":0.67256}],"urls":["https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-12243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-12243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-10-09","epss":0.01292,"percentile":0.69427}],"risk":0.66538,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-12243","description":"A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2024-12243","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-10-09","epss":0.01292,"percentile":0.69427}],"urls":["https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:4051","https://access.redhat.com/errata/RHSA-2025:7076","https://access.redhat.com/errata/RHSA-2025:8020","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-12243","https://bugzilla.redhat.com/show_bug.cgi?id=2344615","https://gitlab.com/gnutls/gnutls/-/issues/1553","https://gitlab.com/gnutls/libtasn1/-/issues/52","https://lists.debian.org/debian-lts-announce/2025/02/msg00027.html","https://security.netapp.com/advisory/ntap-20250523-0002/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12243","description":"A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84838","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84838","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-09","epss":0.01,"percentile":0.61724}],"risk":0.64,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."},"relatedVulnerabilities":[{"id":"CVE-2026-84838","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-09","epss":0.01,"percentile":0.61724}],"urls":["https://access.redhat.com/security/cve/CVE-2026-84838","https://bugzilla.redhat.com/show_bug.cgi?id=2462222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84838","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84838","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-09","epss":0.01,"percentile":0.61724}],"risk":0.64,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."},"relatedVulnerabilities":[{"id":"CVE-2026-84838","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-09","epss":0.01,"percentile":0.61724}],"urls":["https://access.redhat.com/security/cve/CVE-2026-84838","https://bugzilla.redhat.com/show_bug.cgi?id=2462222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."}]},{"artifact":{"id":"bc38c5eb112b7517","cpes":["cpe:2.3:a:redhat:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=x86_64&distro=rhel-10.2&upstream=wget-1.24.5-8.el10_2.src.rpm","type":"rpm","version":"1.24.5-8.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later AND GFDL-1.3-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-10524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"wget","version":"0:1.24.5-8.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-10524","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":3.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-10-09","epss":0.01071,"percentile":0.6386}],"risk":0.615825,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-10524","description":"A flaw was found in the Wget package. Wget might issue an FTP request to a different host in configurations where the HTTP shorthand format is used with user-provided input. An attacker may be able to use specially crafted input to cause Wget to access an arbitrary host."},"relatedVulnerabilities":[{"id":"CVE-2024-10524","cvss":[{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":3.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-10-09","epss":0.01071,"percentile":0.6386}],"urls":["https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778","https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/","https://seclists.org/oss-sec/2024/q4/107","http://www.openwall.com/lists/oss-security/2024/11/18/6","https://security.netapp.com/advisory/ntap-20250321-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-9232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-10-09","epss":0.02001,"percentile":0.80148}],"risk":0.610305,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9232","description":"A flaw was found in the OpenSSL HTTP client API no_proxy handling. This vulnerability allows an application level denial of service (application crash) via an attacker-controlled IPv6 URL when the no_proxy environment variable is set."},"relatedVulnerabilities":[{"id":"CVE-2025-9232","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-10-09","epss":0.02001,"percentile":0.80148}],"urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-09","epss":0.01348,"percentile":0.70655}],"risk":0.5998600000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-09","epss":0.01348,"percentile":0.70655}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-09","epss":0.01348,"percentile":0.70655}],"risk":0.5998600000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-09","epss":0.01348,"percentile":0.70655}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"ee20a0d6e984ac85","cpes":["cpe:2.3:a:libtasn1:libtasn1:4.20.0-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtasn1:4.20.0-5.el10_2:*:*:*:*:*:*:*"],"name":"libtasn1","purl":"pkg:rpm/redhat/libtasn1@4.20.0-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libtasn1-4.20.0-5.el10_2.src.rpm","type":"rpm","version":"4.20.0-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-12133","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libtasn1","version":"0:4.20.0-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-12133","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-10-09","epss":0.0111,"percentile":0.64933}],"risk":0.57165,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-12133","description":"A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack."},"relatedVulnerabilities":[{"id":"CVE-2024-12133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-10-09","epss":0.0111,"percentile":0.64933}],"urls":["https://access.redhat.com/errata/RHSA-2025:17347","https://access.redhat.com/errata/RHSA-2025:4049","https://access.redhat.com/errata/RHSA-2025:7077","https://access.redhat.com/errata/RHSA-2025:8021","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/security/cve/CVE-2024-12133","https://bugzilla.redhat.com/show_bug.cgi?id=2344611","https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md","https://gitlab.com/gnutls/libtasn1/-/issues/52","http://www.openwall.com/lists/oss-security/2025/02/06/6","https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html","https://security.netapp.com/advisory/ntap-20250523-0003/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12133","description":"A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-10-09","epss":0.00969,"percentile":0.60743}],"risk":0.528105,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."},"relatedVulnerabilities":[{"id":"CVE-2026-0990","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-10-09","epss":0.00969,"percentile":0.60743}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0990","https://bugzilla.redhat.com/show_bug.cgi?id=2429959","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41996","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-41996","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-10-09","epss":0.01083,"percentile":0.64192}],"risk":0.481935,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41996","description":"A vulnerability was found in the Diffie-Hellman Ephemeral (DHE) Key Agreement Protocol, where a malicious client can exploit the server's public key validation process. By forcing the server to use DHE and validating the order of public keys, the client can trigger expensive server-side modular exponentiation calculations. This issue results in asymmetric resource consumption, potentially leading to a denial of service (DoS) attack by overwhelming the server with computationally intensive operations."},"relatedVulnerabilities":[{"id":"CVE-2024-41996","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-10-09","epss":0.01083,"percentile":0.64192}],"urls":["https://dheatattack.gitlab.io/details/","https://dheatattack.gitlab.io/faq/","https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4603","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-4603","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4603","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-4603","cwe":"CWE-834","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4603","date":"2026-10-09","epss":0.01131,"percentile":0.65446}],"risk":0.46936500000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-4603","description":"A flaw was found in OpenSSL. Applications that use the EVP_PKEY_param_check() or EVP_PKEY_public_check() function to check a DSA public key or DSA parameters may experience long delays when checking excessively long DSA keys or parameters.  In applications that allow untrusted sources to provide the key or parameters that are checked, an attacker may be able to cause a denial of service. These functions are not called by OpenSSL on untrusted DSA keys. The applications that directly call these functions are the ones that may be vulnerable to this issue."},"relatedVulnerabilities":[{"id":"CVE-2024-4603","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4603","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-4603","cwe":"CWE-834","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4603","date":"2026-10-09","epss":0.01131,"percentile":0.65446}],"urls":["https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397","https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e","https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d","https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740","https://www.openssl.org/news/secadv/20240516.txt","http://www.openwall.com/lists/oss-security/2024/05/16/2","https://security.netapp.com/advisory/ntap-20240621-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4603","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-21140","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-21140","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21140","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21140","date":"2026-10-09","epss":0.0094,"percentile":0.59783}],"risk":0.4606,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-21140","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[{"id":"CVE-2024-21140","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21140","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21140","date":"2026-10-09","epss":0.0094,"percentile":0.59783}],"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21140","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."}]},{"artifact":{"id":"fbffc6e728ed9716","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-09","epss":0.00581,"percentile":0.46085}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-09","epss":0.00581,"percentile":0.46085}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"0a8de48e03df3f32","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.1","type":"java-archive","version":"2.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.22.0,<2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.22.2"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.22.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-09","epss":0.00581,"percentile":0.46085}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-09","epss":0.00581,"percentile":0.46085}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"risk":0.42952499999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19931","description":"A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"risk":0.42952499999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19931","description":"A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"306f43c8ded95480","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-09","epss":0.00546,"percentile":0.44076}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-09","epss":0.00546,"percentile":0.44076}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"b981013787a78316","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.22.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.1","type":"java-archive","version":"2.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-09","epss":0.00546,"percentile":0.44076}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-09","epss":0.00546,"percentile":0.44076}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"087be48dad3cc270","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.22.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.2","type":"java-archive","version":"2.22.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/jackson-core-2.22.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"13a748ea3e329fa220076e021b45c8391b32420c","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/jackson-core-2.22.2.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/jackson-core-2.22.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.22.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-09","epss":0.00546,"percentile":0.44076}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-09","epss":0.00546,"percentile":0.44076}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-09","epss":0.00885,"percentile":0.58023}],"risk":0.3938250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28388","description":"A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-09","epss":0.00885,"percentile":0.58023}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-09","epss":0.0075,"percentile":0.536}],"risk":0.38625,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-09","epss":0.0075,"percentile":0.536}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-09","epss":0.0075,"percentile":0.536}],"risk":0.38625,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-09","epss":0.0075,"percentile":0.536}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"fbffc6e728ed9716","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-09","epss":0.00717,"percentile":0.52423}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-09","epss":0.00717,"percentile":0.52423}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"0a8de48e03df3f32","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.1","type":"java-archive","version":"2.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.22.0,<2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.22.2"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.22.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-09","epss":0.00717,"percentile":0.52423}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-09","epss":0.00717,"percentile":0.52423}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-09","epss":0.00657,"percentile":0.49945}],"risk":0.37777499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-09","epss":0.00657,"percentile":0.49945}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-09","epss":0.00657,"percentile":0.49945}],"risk":0.37777499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-09","epss":0.00657,"percentile":0.49945}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-28834","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-28834","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28834","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28834","date":"2026-10-09","epss":0.00724,"percentile":0.52664}],"risk":0.37285999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-28834","description":"A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel."},"relatedVulnerabilities":[{"id":"CVE-2024-28834","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28834","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28834","date":"2026-10-09","epss":0.00724,"percentile":0.52664}],"urls":["https://access.redhat.com/errata/RHSA-2024:1784","https://access.redhat.com/errata/RHSA-2024:1879","https://access.redhat.com/errata/RHSA-2024:1997","https://access.redhat.com/errata/RHSA-2024:2044","https://access.redhat.com/errata/RHSA-2024:2570","https://access.redhat.com/errata/RHSA-2024:2889","https://access.redhat.com/security/cve/CVE-2024-28834","https://bugzilla.redhat.com/show_bug.cgi?id=2269228","https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html","https://minerva.crocs.fi.muni.cz/","http://www.openwall.com/lists/oss-security/2024/03/22/1","http://www.openwall.com/lists/oss-security/2024/03/22/2","https://lists.debian.org/debian-lts-announce/2024/09/msg00019.html","https://people.redhat.com/~hkario/marvin/","https://security.netapp.com/advisory/ntap-20240524-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28834","description":"A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-09","epss":0.00581,"percentile":0.46112}],"risk":0.37184,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-09","epss":0.00581,"percentile":0.46112}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-09","epss":0.00581,"percentile":0.46112}],"risk":0.37184,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-09","epss":0.00581,"percentile":0.46112}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"306f43c8ded95480","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-09","epss":0.00492,"percentile":0.40389}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-09","epss":0.00492,"percentile":0.40389}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"b981013787a78316","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.22.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.1","type":"java-archive","version":"2.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-09","epss":0.00492,"percentile":0.40389}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-09","epss":0.00492,"percentile":0.40389}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"087be48dad3cc270","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.22.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.2","type":"java-archive","version":"2.22.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/jackson-core-2.22.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"13a748ea3e329fa220076e021b45c8391b32420c","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/jackson-core-2.22.2.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/jackson-core-2.22.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.22.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-09","epss":0.00492,"percentile":0.40389}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-09","epss":0.00492,"percentile":0.40389}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-09","epss":0.00805,"percentile":0.55469}],"risk":0.358225,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28389","description":"A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data."},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-09","epss":0.00805,"percentile":0.55469}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"fbffc6e728ed9716","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"fbffc6e728ed9716","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"0a8de48e03df3f32","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.1","type":"java-archive","version":"2.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"0a8de48e03df3f32","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.1","type":"java-archive","version":"2.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"d1ae7c9bc7dd1a53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.2","type":"java-archive","version":"2.22.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/jackson-databind-2.22.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"921bd2092b0c539b2876de7063d55c72edcd05d3","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/jackson-databind-2.22.2.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/jackson-databind-2.22.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.22.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"d1ae7c9bc7dd1a53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.2","type":"java-archive","version":"2.22.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/jackson-databind-2.22.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"921bd2092b0c539b2876de7063d55c72edcd05d3","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/jackson-databind-2.22.2.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/jackson-databind-2.22.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.22.0,<=2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.22.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.22.3"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.22.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-09","epss":0.0045,"percentile":0.37176}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59871","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-59871","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59871","date":"2026-10-09","epss":0.00644,"percentile":0.49318}],"risk":0.33166,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59871","description":"A flaw was found in node-tar, a library for manipulating tar archives in Node.js. This vulnerability occurs when the library incorrectly converts specific archive path values into numbers, leading to an error during subsequent path processing. An attacker could exploit this to cause the application using node-tar to crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-59871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59871","date":"2026-10-09","epss":0.00644,"percentile":0.49318}],"urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-09","epss":0.0068,"percentile":0.50974}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-09","epss":0.0068,"percentile":0.50974}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-09","epss":0.0068,"percentile":0.50974}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-09","epss":0.0068,"percentile":0.50974}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4426","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4426","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-10-09","epss":0.0056,"percentile":0.44931}],"risk":0.32199999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-4426","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-10-09","epss":0.0056,"percentile":0.44931}],"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-4426","https://bugzilla.redhat.com/show_bug.cgi?id=2449010","https://github.com/libarchive/libarchive/pull/2897"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-27113","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-27113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-10-09","epss":0.01053,"percentile":0.63345}],"risk":0.321165,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-27113","description":"A flaw was found in libxml2. This vulnerability allows a NULL pointer dereference, leading to a potential crash or denial of service via a crafted XML pattern."},"relatedVulnerabilities":[{"id":"CVE-2025-27113","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-10-09","epss":0.01053,"percentile":0.63345}],"urls":["https://gitlab.gnome.org/GNOME/libxml2/-/issues/861","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://security.netapp.com/advisory/ntap-20250306-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27113","description":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-09","epss":0.00394,"percentile":0.31469}],"risk":0.30928999999999995,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86145","description":"A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system."},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-09","epss":0.00394,"percentile":0.31469}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-09","epss":0.00394,"percentile":0.31469}],"risk":0.30928999999999995,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86145","description":"A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system."},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-09","epss":0.00394,"percentile":0.31469}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-09","epss":0.0055,"percentile":0.44305}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-09","epss":0.0055,"percentile":0.44305}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-09","epss":0.0055,"percentile":0.44305}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-09","epss":0.0055,"percentile":0.44305}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-09","epss":0.00591,"percentile":0.46648}],"risk":0.304365,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-09","epss":0.00591,"percentile":0.46648}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-09","epss":0.00591,"percentile":0.46648}],"risk":0.304365,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-09","epss":0.00591,"percentile":0.46648}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-09","epss":0.00512,"percentile":0.41829}],"risk":0.2944,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-09","epss":0.00512,"percentile":0.41829}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-09","epss":0.00512,"percentile":0.41829}],"risk":0.2944,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-09","epss":0.00512,"percentile":0.41829}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-09","epss":0.0051,"percentile":0.41656}],"risk":0.29324999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-09","epss":0.0051,"percentile":0.41656}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-09","epss":0.0051,"percentile":0.41656}],"risk":0.29324999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-09","epss":0.0051,"percentile":0.41656}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-10536","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-10536","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"risk":0.29002999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-10536","description":"A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10536","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-10536","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"risk":0.29002999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-10536","description":"A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32316","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-32316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.8,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32316","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-32316","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32316","date":"2026-10-09","epss":0.00486,"percentile":0.39942}],"risk":0.28673999999999994,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32316","description":"A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-32316","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32316","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-32316","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32316","date":"2026-10-09","epss":0.00486,"percentile":0.39942}],"urls":["https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5","https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32316","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5."}]},{"artifact":{"id":"fbffc6e728ed9716","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/products/neo4j-graph-data-science-2.13.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-09","epss":0.00529,"percentile":0.42998}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-09","epss":0.00529,"percentile":0.42998}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"0a8de48e03df3f32","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.22.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.1","type":"java-archive","version":"2.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/parquet-jackson-1.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.22.0,<2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.22.2"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.22.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-09","epss":0.00529,"percentile":0.42998}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-09","epss":0.00529,"percentile":0.42998}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-29087","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-29087","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-29087","date":"2026-10-09","epss":0.00517,"percentile":0.42202}],"risk":0.271425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-29087","description":"A flaw was found in SQLite. This vulnerability allows an attacker to cause an integer overflow via the concat_ws function."},"relatedVulnerabilities":[{"id":"CVE-2025-29087","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":3.2,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-29087","date":"2026-10-09","epss":0.00517,"percentile":0.42202}],"urls":["https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a","https://sqlite.org/releaselog/3_49_1.html","https://www.sqlite.org/cves.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-29087","description":"In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59875","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-59875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59875","date":"2026-10-09","epss":0.00507,"percentile":0.41381}],"risk":0.26110500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59875","description":"A flaw was found in node-tar, a library for manipulating tar archives in Node.js. A remote attacker could craft a malicious archive containing null characters (NUL bytes) in its metadata. When this archive is processed, the unstripped null characters can cause the application to terminate unexpectedly, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-59875","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59875","date":"2026-10-09","epss":0.00507,"percentile":0.41381}],"urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17."}]},{"artifact":{"id":"e8e4e4186e95c503","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.3-10.el10_2?arch=x86_64&distro=rhel-10.2&upstream=krb5-1.21.3-10.el10_2.src.rpm","type":"rpm","version":"1.21.3-10.el10_2","language":"","licenses":["Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.3-10.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"krb5","version":"1.21.3-10.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107708","description":"A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center (KDC) to cause a Denial of Service (DoS). By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate (PAC), an attacker can trigger a NULL pointer dereference that crashes the KDC daemon, interrupting authentication services."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"18903e2417661546","cpes":["cpe:2.3:a:libgcc:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-09","epss":0.00779,"percentile":0.54562}],"risk":0.24538499999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-09","epss":0.00779,"percentile":0.54562}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"7e1663f3df86ee06","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-09","epss":0.00779,"percentile":0.54562}],"risk":0.24538499999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-09","epss":0.00779,"percentile":0.54562}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"e8e4e4186e95c503","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.3-10.el10_2?arch=x86_64&distro=rhel-10.2&upstream=krb5-1.21.3-10.el10_2.src.rpm","type":"rpm","version":"1.21.3-10.el10_2","language":"","licenses":["Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.3-10.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"krb5","version":"1.21.3-10.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"risk":0.24379999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107778","description":"A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34978","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34978","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-09","epss":0.0042,"percentile":0.34305}],"risk":0.24149999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34978","description":"A flaw was found in OpenPrinting CUPS. A remote attacker can exploit a path traversal vulnerability in the RSS notifier by manipulating the `notify-recipient-uri`. This allows writing arbitrary RSS XML data to sensitive files outside the intended directory. This can lead to a denial of service (DoS) by corrupting critical system files, such as the job cache, causing the scheduler to fail and previously queued jobs to disappear."},"relatedVulnerabilities":[{"id":"CVE-2026-34978","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-09","epss":0.0042,"percentile":0.34305}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34978","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34978","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34978","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-09","epss":0.0042,"percentile":0.34305}],"risk":0.24149999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34978","description":"A flaw was found in OpenPrinting CUPS. A remote attacker can exploit a path traversal vulnerability in the RSS notifier by manipulating the `notify-recipient-uri`. This allows writing arbitrary RSS XML data to sensitive files outside the intended directory. This can lead to a denial of service (DoS) by corrupting critical system files, such as the job cache, causing the scheduler to fail and previously queued jobs to disappear."},"relatedVulnerabilities":[{"id":"CVE-2026-34978","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-09","epss":0.0042,"percentile":0.34305}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34978","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"risk":0.23793,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54873","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data transfers to keep these buffers allocated indefinitely. This behavior leads to excessive memory consumption and can exhaust available system resources."},"relatedVulnerabilities":[{"id":"CVE-2026-54873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-13176","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-10-09","epss":0.00613,"percentile":0.47784}],"risk":0.23600500000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-13176","description":"A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected."},"relatedVulnerabilities":[{"id":"CVE-2024-13176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":3.4,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-10-09","epss":0.00613,"percentile":0.47784}],"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"cfb8d2e6f3a53be0","cpes":["cpe:2.3:a:avahi-libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi-libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*"],"name":"avahi-libs","purl":"pkg:rpm/redhat/avahi-libs@0.9~rc2-2.el10?arch=x86_64&distro=rhel-10.2&upstream=avahi-0.9~rc2-2.el10.src.rpm","type":"rpm","version":"0.9~rc2-2.el10","language":"","licenses":["LGPL-2.1-or-later AND LGPL-2.0-or-later AND BSD-2-Clause-Views AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"avahi","version":"0.9~rc2-2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68471","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"avahi","version":"0.9~rc2-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-68471","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"risk":0.23287499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-68471","description":"A flaw was found in Avahi, a system that enables devices to discover services on a local network using the mDNS/DNS-SD (Multicast Domain Name System/DNS-based Service Discovery) protocols. A remote attacker can exploit this by sending two specific network messages, known as unsolicited announcements with CNAME resource records, within a two-second timeframe. This action can cause the `avahi-daemon` process to crash, leading to a Denial of Service (DoS) for the affected system."},"relatedVulnerabilities":[{"id":"CVE-2025-68471","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"urls":["https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1","https://github.com/avahi/avahi/issues/678","https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22693","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-22693","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-10-09","epss":0.00452,"percentile":0.37305}],"risk":0.23278000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-22693","description":"A null pointer dereference vector has been discovered in the harfbuzz package. A null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh:1672-1673. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault."},"relatedVulnerabilities":[{"id":"CVE-2026-22693","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-10-09","epss":0.00452,"percentile":0.37305}],"urls":["https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae","https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww","http://www.openwall.com/lists/oss-security/2026/01/11/1","http://www.openwall.com/lists/oss-security/2026/01/12/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22693","description":"HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-09","epss":0.00671,"percentile":0.50549}],"risk":0.22478499999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28387","description":"A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records."},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-09","epss":0.00671,"percentile":0.50549}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"26333e82a7f1194a","cpes":["cpe:2.3:a:redhat:glibc:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"26333e82a7f1194a","cpes":["cpe:2.3:a:redhat:glibc:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"a69a465221b314ff","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"a69a465221b314ff","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"75ec3abb14d3aef9","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"75ec3abb14d3aef9","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"cfb8d2e6f3a53be0","cpes":["cpe:2.3:a:avahi-libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi-libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*"],"name":"avahi-libs","purl":"pkg:rpm/redhat/avahi-libs@0.9~rc2-2.el10?arch=x86_64&distro=rhel-10.2&upstream=avahi-0.9~rc2-2.el10.src.rpm","type":"rpm","version":"0.9~rc2-2.el10","language":"","licenses":["LGPL-2.1-or-later AND LGPL-2.0-or-later AND BSD-2-Clause-Views AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"avahi","version":"0.9~rc2-2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68468","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"avahi","version":"0.9~rc2-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-68468","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-68468","description":"A flaw was found in Avahi. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted unsolicited announcements containing CNAME resource records. These records, when pointing to other resource records with short Time-To-Live (TTL) values, can lead to the `avahi-daemon` crashing once they expire. This vulnerability impacts the availability of services relying on Avahi's service discovery."},"relatedVulnerabilities":[{"id":"CVE-2025-68468","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"urls":["https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a","https://github.com/avahi/avahi/issues/683","https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."}]},{"artifact":{"id":"bc38c5eb112b7517","cpes":["cpe:2.3:a:redhat:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=x86_64&distro=rhel-10.2&upstream=wget-1.24.5-8.el10_2.src.rpm","type":"rpm","version":"1.24.5-8.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later AND GFDL-1.3-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-16599","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"wget","version":"0:1.24.5-8.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-16599","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16599","cwe":"CWE-606","type":"Primary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16599","date":"2026-10-09","epss":0.00375,"percentile":0.29382}],"risk":0.21562499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-16599","description":"A flaw was found in wget's FTP OPIE/S-KEY authentication functionality. A malicious FTP server or a network attacker can send a specially crafted OPIE challenge. This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations. This prolonged computation can cause wget to become unresponsive, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-16599","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16599","cwe":"CWE-606","type":"Primary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16599","date":"2026-10-09","epss":0.00375,"percentile":0.29382}],"urls":["https://cert.pl/en/posts/2026/08/CVE-2026-16599","https://gitlab.com/gnuwget/wget","https://gitlab.com/gnuwget/wget/-/commit/e9697d98e7249b0f68a6be040a4f3dcc5bc101fa"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16599","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa"}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34979","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34979","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-09","epss":0.00413,"percentile":0.33578}],"risk":0.212695,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34979","description":"A flaw was found in OpenPrinting CUPS. A remote attacker could exploit a heap-based buffer overflow by sending specially crafted job attributes when building filter option strings. This could lead to a denial of service, making the printing system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-34979","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-09","epss":0.00413,"percentile":0.33578}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34979","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34979","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34979","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-09","epss":0.00413,"percentile":0.33578}],"risk":0.212695,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34979","description":"A flaw was found in OpenPrinting CUPS. A remote attacker could exploit a heap-based buffer overflow by sending specially crafted job attributes when building filter option strings. This could lead to a denial of service, making the printing system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-34979","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-09","epss":0.00413,"percentile":0.33578}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34979","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42765","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42765","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-10-09","epss":0.00477,"percentile":0.39239}],"risk":0.21226500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42765","description":"A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-42765","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-10-09","epss":0.00477,"percentile":0.39239}],"urls":["https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334","https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","description":"Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"risk":0.199305,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75806","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by terminating an active Datagram Transport Layer Security (DTLS) session. By sending an undersized network packet that is shorter than the expected cryptographic overhead, the record processing layer fails to validate the packet length and misinterprets the packet as an internal error rather than an authentication failure. This improper handling triggers a fatal alert that unexpectedly closes the targeted connection without requiring valid encryption keys."},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-33056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-10-09","epss":0.00415,"percentile":0.33838}],"risk":0.19505000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-33056","description":"A flaw was found in tar-rs, a Rust library for reading and writing tar archives. When unpacking a crafted tar archive, an attacker can exploit a symbolic link vulnerability. By including a symlink followed by a directory with the same name, the library incorrectly applies file permissions to the symlink's target. This allows an attacker to modify the permissions of arbitrary directories outside the intended extraction location."},"relatedVulnerabilities":[{"id":"CVE-2026-33056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-10-09","epss":0.00415,"percentile":0.33838}],"urls":["https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446","https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-10148","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-10148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-09","epss":0.00499,"percentile":0.40897}],"risk":0.19460999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-10148","description":"A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server's malicious content and serves it to all users of that proxy."},"relatedVulnerabilities":[{"id":"CVE-2025-10148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-09","epss":0.00499,"percentile":0.40897}],"urls":["https://curl.se/docs/CVE-2025-10148.html","https://curl.se/docs/CVE-2025-10148.json","https://hackerone.com/reports/3330839","http://www.openwall.com/lists/oss-security/2025/09/10/2","http://www.openwall.com/lists/oss-security/2025/09/10/3","http://www.openwall.com/lists/oss-security/2025/09/10/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10148","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-10148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-09","epss":0.00499,"percentile":0.40897}],"risk":0.19460999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-10148","description":"A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server's malicious content and serves it to all users of that proxy."},"relatedVulnerabilities":[{"id":"CVE-2025-10148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-09","epss":0.00499,"percentile":0.40897}],"urls":["https://curl.se/docs/CVE-2025-10148.html","https://curl.se/docs/CVE-2025-10148.json","https://hackerone.com/reports/3330839","http://www.openwall.com/lists/oss-security/2025/09/10/2","http://www.openwall.com/lists/oss-security/2025/09/10/3","http://www.openwall.com/lists/oss-security/2025/09/10/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-28835","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-28835","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28835","cwe":"CWE-248","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28835","date":"2026-10-09","epss":0.00389,"percentile":0.30937}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-28835","description":"A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the \"certtool --verify-chain\" command."},"relatedVulnerabilities":[{"id":"CVE-2024-28835","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28835","cwe":"CWE-248","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28835","date":"2026-10-09","epss":0.00389,"percentile":0.30937}],"urls":["https://access.redhat.com/errata/RHSA-2024:1879","https://access.redhat.com/errata/RHSA-2024:2570","https://access.redhat.com/errata/RHSA-2024:2889","https://access.redhat.com/security/cve/CVE-2024-28835","https://bugzilla.redhat.com/show_bug.cgi?id=2269084","https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html","http://www.openwall.com/lists/oss-security/2024/03/22/1","http://www.openwall.com/lists/oss-security/2024/03/22/2","https://lists.debian.org/debian-lts-announce/2024/09/msg00019.html","https://security.netapp.com/advisory/ntap-20241122-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28835","description":"A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the \"certtool --verify-chain\" command."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1489","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-1489","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-10-09","epss":0.00371,"percentile":0.29047}],"risk":0.19292000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."},"relatedVulnerabilities":[{"id":"CVE-2026-1489","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-10-09","epss":0.00371,"percentile":0.29047}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1489","https://bugzilla.redhat.com/show_bug.cgi?id=2433348","https://gitlab.gnome.org/GNOME/glib/-/issues/3872","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."}]},{"artifact":{"id":"a3fc973d5d02135f","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4v53-57pg-c464","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4v53-57pg-c464","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-10-09","epss":0.00371,"percentile":0.29025}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464","https://nvd.nist.gov/vuln/detail/CVE-2026-106452","https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4v53-57pg-c464","description":"yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"},"relatedVulnerabilities":[{"id":"CVE-2026-106452","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-10-09","epss":0.00371,"percentile":0.29025}],"urls":["https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106452","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"a3fc973d5d02135f","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cx8-rjf8-pr8g","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cx8-rjf8-pr8g","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-10-09","epss":0.00371,"percentile":0.29024}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g","https://nvd.nist.gov/vuln/detail/CVE-2026-106453","https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cx8-rjf8-pr8g","description":"yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError"},"relatedVulnerabilities":[{"id":"CVE-2026-106453","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-10-09","epss":0.00371,"percentile":0.29024}],"urls":["https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106453","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"a3fc973d5d02135f","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gm45-99xc-r7wv","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gm45-99xc-r7wv","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-10-09","epss":0.00371,"percentile":0.29024}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv","https://nvd.nist.gov/vuln/detail/CVE-2026-106450","https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gm45-99xc-r7wv","description":"yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs"},"relatedVulnerabilities":[{"id":"CVE-2026-106450","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-10-09","epss":0.00371,"percentile":0.29024}],"urls":["https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-53427","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-53427","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-53427","cwe":"CWE-843","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-53427","date":"2026-10-09","epss":0.00364,"percentile":0.28158}],"risk":0.18746000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-53427","description":"A flaw was discovered in the jq package. In affected versions, specially-crafted input may trigger an unsafe memory operation leading to a stack buffer overflow. This can cause an application crash or other unintended behavior."},"relatedVulnerabilities":[{"id":"CVE-2024-53427","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-53427","cwe":"CWE-843","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-53427","date":"2026-10-09","epss":0.00364,"percentile":0.28158}],"urls":["https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92","https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375","https://github.com/jqlang/jq/issues/3196","https://github.com/jqlang/jq/issues/3296","https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-53427","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits)."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-09","epss":0.00359,"percentile":0.27616}],"risk":0.184885,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-09","epss":0.00359,"percentile":0.27616}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-09","epss":0.00359,"percentile":0.27616}],"risk":0.184885,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-09","epss":0.00359,"percentile":0.27616}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-09","epss":0.0048,"percentile":0.39488}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-09","epss":0.0048,"percentile":0.39488}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-09","epss":0.0048,"percentile":0.39488}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-09","epss":0.0048,"percentile":0.39488}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40930","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-40930","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40930","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-40930","date":"2026-10-09","epss":0.00355,"percentile":0.27243}],"risk":0.18460000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-40930","description":"A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. In version 1.8.0, a remote attacker could provide a specially crafted APNG (Animated Portable Network Graphics) file. This flaw allows attacker-controlled data within an ignored chunk to be reinterpreted as a new chunk header, leading to a low impact on data integrity and availability. This could result in unexpected application behavior or a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-40930","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40930","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-40930","date":"2026-10-09","epss":0.00355,"percentile":0.27243}],"urls":["https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4","https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x","http://www.openwall.com/lists/oss-security/2026/05/15/21"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40930","description":"LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue."}]},{"artifact":{"id":"10083edcbc977dbf","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-67897","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-67897","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-67897","cwe":"CWE-195","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-67897","date":"2026-10-09","epss":0.00354,"percentile":0.27121}],"risk":0.18231000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-67897","description":"A flaw was found in Sequoia. This vulnerability allows a remote attacker to crash an application via sending a victim an encrypted message with a crafted Public Key Encrypted Session Key (PKESK) or Symmetric Key Encrypted Session Key (SKESK) packet, which causes `aes_key_unwrap` to panic when processing a short ciphertext."},"relatedVulnerabilities":[{"id":"CVE-2025-67897","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-67897","cwe":"CWE-195","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-67897","date":"2026-10-09","epss":0.00354,"percentile":0.27121}],"urls":["https://bugs.debian.org/1122582","https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26","https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-67897","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87875","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-87875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-09","epss":0.00392,"percentile":0.31258}],"risk":0.18228,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."},"relatedVulnerabilities":[{"id":"CVE-2026-87875","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-09","epss":0.00392,"percentile":0.31258}],"urls":["https://access.redhat.com/errata/RHSA-2026:66600","https://access.redhat.com/security/cve/CVE-2026-87875","https://bugzilla.redhat.com/show_bug.cgi?id=2530994","https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87875","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-87875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-09","epss":0.00392,"percentile":0.31258}],"risk":0.18228,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."},"relatedVulnerabilities":[{"id":"CVE-2026-87875","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-09","epss":0.00392,"percentile":0.31258}],"urls":["https://access.redhat.com/errata/RHSA-2026:66600","https://access.redhat.com/security/cve/CVE-2026-87875","https://bugzilla.redhat.com/show_bug.cgi?id=2530994","https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75804","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"risk":0.18128,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75804","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can force the system to buffer far more data than permitted by the connection limit. This excessive memory allocation can exhaust available system resources and degrade or terminate the service."},"relatedVulnerabilities":[{"id":"CVE-2026-75804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0989","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0989","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-10-09","epss":0.00538,"percentile":0.4358}],"risk":0.18023,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."},"relatedVulnerabilities":[{"id":"CVE-2026-0989","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-10-09","epss":0.00538,"percentile":0.4358}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0989","https://bugzilla.redhat.com/show_bug.cgi?id=2429933","https://gitlab.gnome.org/GNOME/libxml2/-/issues/998"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."}]},{"artifact":{"id":"26333e82a7f1194a","cpes":["cpe:2.3:a:redhat:glibc:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"risk":0.17612999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"a69a465221b314ff","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"risk":0.17612999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"75ec3abb14d3aef9","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"risk":0.17612999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-6052","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-6052","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6052","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6052","date":"2026-10-09","epss":0.00522,"percentile":0.42502}],"risk":0.17486999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-6052","description":"A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2025-6052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6052","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6052","date":"2026-10-09","epss":0.00522,"percentile":0.42502}],"urls":["https://access.redhat.com/security/cve/CVE-2025-6052","https://bugzilla.redhat.com/show_bug.cgi?id=2372666","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://openjdk.org/groups/vulnerability/advisories/2026-01-20","https://www.oracle.com/security-alerts/cpuapr2026.html","https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6052","description":"A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption."}]},{"artifact":{"id":"cfb8d2e6f3a53be0","cpes":["cpe:2.3:a:avahi-libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi-libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*"],"name":"avahi-libs","purl":"pkg:rpm/redhat/avahi-libs@0.9~rc2-2.el10?arch=x86_64&distro=rhel-10.2&upstream=avahi-0.9~rc2-2.el10.src.rpm","type":"rpm","version":"0.9~rc2-2.el10","language":"","licenses":["LGPL-2.1-or-later AND LGPL-2.0-or-later AND BSD-2-Clause-Views AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"avahi","version":"0.9~rc2-2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24401","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"avahi","version":"0.9~rc2-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-24401","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"risk":0.17019999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-24401","description":"A flaw was found in Avahi, a system that enables devices to discover services on a local network. A remote attacker can exploit this vulnerability by sending a specially crafted mDNS (multicast Domain Name System) response containing a recursive CNAME (Canonical Name) record. This triggers an uncontrolled recursion within the avahi-daemon process, leading to stack exhaustion and causing the service to crash. This results in a denial of service (DoS) for affected systems."},"relatedVulnerabilities":[{"id":"CVE-2026-24401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"urls":["https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","https://github.com/avahi/avahi/issues/501","https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42772","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"risk":0.16995000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42772","description":"A flaw was found in OpenSSL. A remote attacker who establishes a QUIC network connection can cause a Denial of Service (DoS) by sending specially sequenced, out-of-order stream frames. Because the stream reassembly mechanism handles non-sequential data fragments inefficiently, processing these frames forces the server to consume excessive CPU resources. Consequently, an attacker can exhaust system processing capacity using minimal network bandwidth."},"relatedVulnerabilities":[{"id":"CVE-2026-42772","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"95155a12be9544f8","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.4.5-4.el10_1?arch=x86_64&distro=rhel-10.2&upstream=gnupg2-2.4.5-4.el10_1.src.rpm","type":"rpm","version":"2.4.5-4.el10_1","language":"","licenses":["CC0-1.0 AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later AND (BSD-3-Clause OR LGPL-3.0-or-later OR GPL-2.0-or-later) AND CC-BY-4.0 AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24883","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnupg2","version":"0:2.4.5-4.el10_1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-24883","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24883","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24883","date":"2026-10-09","epss":0.00498,"percentile":0.40782}],"risk":0.16683,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-24883","description":"A flaw was found in GnuPG. A remote attacker could provide a specially crafted long signature packet that, when processed, causes the application to crash. This vulnerability leads to a denial of service (DoS), making the GnuPG application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-24883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24883","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24883","date":"2026-10-09","epss":0.00498,"percentile":0.40782}],"urls":["https://dev.gnupg.org/T8049","https://www.openwall.com/lists/oss-security/2026/01/27/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24883","description":"In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash)."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-09","epss":0.00214,"percentile":0.10829}],"risk":0.16157000000000002,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103111","description":"A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-09","epss":0.00214,"percentile":0.10829}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-09","epss":0.00214,"percentile":0.10829}],"risk":0.16157000000000002,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103111","description":"A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-09","epss":0.00214,"percentile":0.10829}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"risk":0.16046499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13608","description":"A flaw was found in libcurl's SASL (Simple Authentication and Security Layer) negotiation for LDAP (Lightweight Directory Access Protocol) authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack, could inject a premature response to bypass complete peer validation, leading to an authentication bypass."},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"risk":0.16046499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13608","description":"A flaw was found in libcurl's SASL (Simple Authentication and Security Layer) negotiation for LDAP (Lightweight Directory Access Protocol) authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack, could inject a premature response to bypass complete peer validation, leading to an authentication bypass."},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1484","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-1484","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-10-09","epss":0.00346,"percentile":0.26163}],"risk":0.15916,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."},"relatedVulnerabilities":[{"id":"CVE-2026-1484","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-10-09","epss":0.00346,"percentile":0.26163}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1484","https://bugzilla.redhat.com/show_bug.cgi?id=2433259","https://gitlab.gnome.org/GNOME/glib/-/issues/3870","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-3360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-3360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-10-09","epss":0.00475,"percentile":0.3912}],"risk":0.159125,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."},"relatedVulnerabilities":[{"id":"CVE-2025-3360","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-10-09","epss":0.00475,"percentile":0.3912}],"urls":["https://access.redhat.com/security/cve/CVE-2025-3360","https://bugzilla.redhat.com/show_bug.cgi?id=2357754","https://gitlab.gnome.org/GNOME/glib/-/issues/3647","https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html","https://gitlab.gnome.org/GNOME/glib/-/work_items/3647"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."}]},{"artifact":{"id":"18903e2417661546","cpes":["cpe:2.3:a:libgcc:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"risk":0.15,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"7e1663f3df86ee06","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"risk":0.15,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-41079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-09","epss":0.00409,"percentile":0.33069}],"risk":0.149285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41079","description":"A flaw was found in CUPS. A network-adjacent attacker can send a specially crafted Simple Network Management Protocol (SNMP) response to the CUPS SNMP backend, leading to an out-of-bounds read. This vulnerability allows for the disclosure of up to 176 bytes of sensitive memory, which is then converted and stored as printer supply description strings. Authenticated users can subsequently view this leaked information through IPP Get-Printer-Attributes responses and the CUPS web interface."},"relatedVulnerabilities":[{"id":"CVE-2026-41079","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-09","epss":0.00409,"percentile":0.33069}],"urls":["https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080","https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737","https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-41079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-09","epss":0.00409,"percentile":0.33069}],"risk":0.149285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41079","description":"A flaw was found in CUPS. A network-adjacent attacker can send a specially crafted Simple Network Management Protocol (SNMP) response to the CUPS SNMP backend, leading to an out-of-bounds read. This vulnerability allows for the disclosure of up to 176 bytes of sensitive memory, which is then converted and stored as printer supply description strings. Authenticated users can subsequently view this leaked information through IPP Get-Printer-Attributes responses and the CUPS web interface."},"relatedVulnerabilities":[{"id":"CVE-2026-41079","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-09","epss":0.00409,"percentile":0.33069}],"urls":["https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080","https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737","https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17."}]},{"artifact":{"id":"5a7d276eca46539a","cpes":["cpe:2.3:a:cyrus-sasl-lib:cyrus-sasl-lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl-lib:cyrus_sasl_lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl_lib:cyrus-sasl-lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl_lib:cyrus_sasl_lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl:cyrus-sasl-lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl:cyrus_sasl_lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl:cyrus-sasl-lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl:cyrus_sasl_lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cyrus-sasl-lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cyrus_sasl_lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus:cyrus-sasl-lib:2.1.28-30.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cyrus:cyrus_sasl_lib:2.1.28-30.el10_2:*:*:*:*:*:*:*"],"name":"cyrus-sasl-lib","purl":"pkg:rpm/redhat/cyrus-sasl-lib@2.1.28-30.el10_2?arch=x86_64&distro=rhel-10.2&upstream=cyrus-sasl-2.1.28-30.el10_2.src.rpm","type":"rpm","version":"2.1.28-30.el10_2","language":"","licenses":["BSD-Attribution-HPND-disclaimer"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cyrus-sasl","version":"2.1.28-30.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cyrus-sasl","version":"2.1.28-30.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-09","epss":0.00238,"percentile":0.13621}],"risk":0.14875000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-09","epss":0.00238,"percentile":0.13621}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-09","epss":0.00278,"percentile":0.18599}],"risk":0.14873,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89157","description":"A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-09","epss":0.00278,"percentile":0.18599}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-09","epss":0.00278,"percentile":0.18599}],"risk":0.14873,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89157","description":"A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-09","epss":0.00278,"percentile":0.18599}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27447","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27447","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27447","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-27447","date":"2026-10-09","epss":0.0026,"percentile":0.16217}],"risk":0.1482,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27447","description":"A flaw was found in OpenPrinting CUPS. This authorization bypass vulnerability allows an unprivileged user to gain unauthorized access to restricted operations. This can be exploited by using a username that differs only in case from an authorized user during authorization checks."},"relatedVulnerabilities":[{"id":"CVE-2026-27447","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.3,"impactScore":4.3,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":4.3,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27447","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-27447","date":"2026-10-09","epss":0.0026,"percentile":0.16217}],"urls":["https://github.com/OpenPrinting/cups/commit/88516bf6d9e34cef7a64a704b856b837f70cd220","https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27447","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27447","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27447","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27447","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-27447","date":"2026-10-09","epss":0.0026,"percentile":0.16217}],"risk":0.1482,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27447","description":"A flaw was found in OpenPrinting CUPS. This authorization bypass vulnerability allows an unprivileged user to gain unauthorized access to restricted operations. This can be exploited by using a username that differs only in case from an authorized user during authorization checks."},"relatedVulnerabilities":[{"id":"CVE-2026-27447","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.3,"impactScore":4.3,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":4.3,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27447","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-27447","date":"2026-10-09","epss":0.0026,"percentile":0.16217}],"urls":["https://github.com/OpenPrinting/cups/commit/88516bf6d9e34cef7a64a704b856b837f70cd220","https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27447","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0988","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0988","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-10-09","epss":0.00441,"percentile":0.36339}],"risk":0.14773499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-0988","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-10-09","epss":0.00441,"percentile":0.36339}],"urls":["https://access.redhat.com/errata/RHSA-2026:7461","https://access.redhat.com/security/cve/CVE-2026-0988","https://bugzilla.redhat.com/show_bug.cgi?id=2429886","https://gitlab.gnome.org/GNOME/glib/-/issues/3851"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-72897","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"risk":0.14497000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-72897","description":"A flaw was found in openssl. When a server replaces its security context during an active Transport Layer Security (TLS) handshake, it fails to update the internal capacity tracking for cryptographic signature algorithms. A remote peer can exploit this issue by advertising specific signature algorithms, causing out-of-bounds memory reads and writes on the server heap. This vulnerability can corrupt internal memory and terminate the process, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-72897","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54872","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-09","epss":0.00263,"percentile":0.16604}],"risk":0.14333500000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54872","description":"A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm (ECDSA) or SM2, using curves without dedicated constant-time implementations, variations in processing time leak information about the per-signature secret value. By measuring the duration of numerous signing operations, an attacker can analyze these timing differences to reconstruct the private signing key."},"relatedVulnerabilities":[{"id":"CVE-2026-54872","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-09","epss":0.00263,"percentile":0.16604}],"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-09","epss":0.00186,"percentile":0.07566}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54875","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-54875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54875","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54875","date":"2026-10-09","epss":0.00294,"percentile":0.20178}],"risk":0.14259,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54875","description":"A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side channel during decryption or digital signature generation. This vulnerability allows the attacker to deduce sensitive private keys or signature nonces, leading to information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-54875","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54875","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54875","date":"2026-10-09","epss":0.00294,"percentile":0.20178}],"urls":["https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54875","description":"Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov"}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-09","epss":0.00247,"percentile":0.14646}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89158","description":"A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-09","epss":0.00247,"percentile":0.14646}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-09","epss":0.00247,"percentile":0.14646}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89158","description":"A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-09","epss":0.00247,"percentile":0.14646}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-09","epss":0.00239,"percentile":0.13719}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-09","epss":0.00239,"percentile":0.13719}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-09","epss":0.00239,"percentile":0.13719}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-09","epss":0.00239,"percentile":0.13719}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0992","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0992","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-10-09","epss":0.00465,"percentile":0.38352}],"risk":0.137175,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2026-0992","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-10-09","epss":0.00465,"percentile":0.38352}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0992","https://bugzilla.redhat.com/show_bug.cgi?id=2429975","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."}]},{"artifact":{"id":"e8e4e4186e95c503","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.3-10.el10_2?arch=x86_64&distro=rhel-10.2&upstream=krb5-1.21.3-10.el10_2.src.rpm","type":"rpm","version":"1.21.3-10.el10_2","language":"","licenses":["Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.3-10.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11850","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"krb5","version":"1.21.3-10.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-11850","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-10-09","epss":0.00271,"percentile":0.17742}],"risk":0.1355,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."},"relatedVulnerabilities":[{"id":"CVE-2026-11850","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-10-09","epss":0.00271,"percentile":0.17742}],"urls":["https://access.redhat.com/errata/RHSA-2026:25520","https://access.redhat.com/security/cve/CVE-2026-11850","https://bugzilla.redhat.com/show_bug.cgi?id=2459970"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-7039","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-7039","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-10-09","epss":0.00397,"percentile":0.31833}],"risk":0.13299499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."},"relatedVulnerabilities":[{"id":"CVE-2025-7039","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-10-09","epss":0.00397,"percentile":0.31833}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7039","https://bugzilla.redhat.com/show_bug.cgi?id=2392423","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77696","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-09","epss":0.00243,"percentile":0.14273}],"risk":0.132435,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77696","description":"A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, which may allow them to recover the private key."},"relatedVulnerabilities":[{"id":"CVE-2026-77696","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-09","epss":0.00243,"percentile":0.14273}],"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7458","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-7458","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7458","cwe":"CWE-190","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-7458","date":"2026-10-09","epss":0.00237,"percentile":0.13542}],"risk":0.13153499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-7458","description":"An integer overflow flaw has been discovered in SQLite. This flaw allows an attacker who has the ability to execute raw SQL statements to induce a denial of service or leak process memory."},"relatedVulnerabilities":[{"id":"CVE-2025-7458","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7458","cwe":"CWE-190","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-7458","date":"2026-10-09","epss":0.00237,"percentile":0.13542}],"urls":["https://sqlite.org/forum/forumpost/16ce2bb7a639e29b","https://sqlite.org/src/info/12ad822d9b827777"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7458","description":"An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause."}]},{"artifact":{"id":"bc38c5eb112b7517","cpes":["cpe:2.3:a:redhat:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=x86_64&distro=rhel-10.2&upstream=wget-1.24.5-8.el10_2.src.rpm","type":"rpm","version":"1.24.5-8.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later AND GFDL-1.3-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-58470","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"wget","version":"0:1.24.5-8.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-58470","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58470","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58470","date":"2026-10-09","epss":0.00247,"percentile":0.14685}],"risk":0.127205,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-58470","description":"An integer overflow in GNU Wget's parse_content_range() function allows malicious servers to send crafted Content-Range headers. This triggers undefined behavior and download desynchronization, potentially causing a denial of service or data integrity issues for the client."},"relatedVulnerabilities":[{"id":"CVE-2026-58470","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58470","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58470","date":"2026-10-09","epss":0.00247,"percentile":0.14685}],"urls":["https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf","https://www.vulncheck.com/advisories/gnu-wget-integer-overflow-via-content-range-header-parsing"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58470","description":"GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5918","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-10-09","epss":0.00368,"percentile":0.28635}],"risk":0.12696,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2025-5918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-10-09","epss":0.00368,"percentile":0.28635}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5918","https://bugzilla.redhat.com/show_bug.cgi?id=2370877","https://github.com/libarchive/libarchive/pull/2584","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1757","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-1757","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-10-09","epss":0.00221,"percentile":0.11593}],"risk":0.12376000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."},"relatedVulnerabilities":[{"id":"CVE-2026-1757","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-10-09","epss":0.00221,"percentile":0.11593}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-1757","https://bugzilla.redhat.com/show_bug.cgi?id=2435940","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84783","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84783","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-10-09","epss":0.00226,"percentile":0.12208}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84783","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-84783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-10-09","epss":0.00226,"percentile":0.12208}],"urls":["https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84783","description":"Issue summary: The first concurrent use of the same X.509 certificate by\nseveral threads may cause its cached extension data to be freed while\nanother thread is still using it.\n\nImpact summary: A remote, unauthenticated peer could crash a multi-threaded\nTLS client, or a multi-threaded TLS server that requests client\ncertificates, if the first certificate chains built to the same trusted CA\ncertificate are built by several connections at the same time. This is a\nuse-after-free read, which is likely to crash the process, resulting in a\nDenial of Service.\n\nCWE: CWE-416: Use After Free\n\nDescription: OpenSSL caches the decoded values of a certificate's X.509v3\nextensions inside the X509 object the first time they are needed. In\nOpenSSL 4.0 this cache is built in two phases: the extension values are\ncomputed while holding a read lock on the certificate, and the results are\nthen installed into the certificate under a write lock. Because a read lock\ndoes not exclude other readers, several threads can compute the cache for\nthe same certificate at the same time. Each thread that subsequently\nacquires the write lock installs its own results and frees the values\ninstalled by the thread before it, even though that earlier thread has\nalready marked the cache as complete and may have returned pointers into it\nto its caller. A caller still using those pointers then reads freed memory.\n\nAny certificate shared between threads is exposed the first time its\nextensions are decoded. In TLS the certificates at risk are the trusted CA\ncertificates supplied for chain verification, by whatever means, since these\nare shared by every connection and their extensions are decoded and cached\nthe first time a chain is built to them. Certificates sent by the peer are\ndecoded separately for each connection and are not shared, so they are not\naffected. In a TLS client verifying server certificates, or a TLS server\nthat requests and verifies client certificates, the use-after-free could\nonly occur if the first chains built to the same trusted CA are built by\nseveral connections at the same time.\n\nFIPS impact: no\nThe FIPS module is not affected as X.509 certificate handling is outside\nof the OpenSSL FIPS module boundary.\n\nOpenSSL 4.0 is vulnerable to this issue.\n\nOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\n\nThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\nindependently in a public report on 31 August 2026 by aydinmercan.\n\nThe fix has been developed by Bob Beck.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Tim Becker (Xint.io), aydinmercan\nFixed by: Bob Beck"}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75805","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75805","date":"2026-10-09","epss":0.00222,"percentile":0.11721}],"risk":0.12099000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75805","description":"A flaw was found in OpenSSL. When a Certificate Management Protocol (CMP) client requests certificate revocation using a PKCS#10 Certificate Signing Request (CSR), it omits the certificate issuer name and serial number. A malicious or compromised CMP server, or an attacker possessing valid message protection credentials, can exploit this flaw by returning a crafted revocation response. This triggers a NULL pointer dereference when the client attempts to compare response data, causing the client application to crash and resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-75805","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75805","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75805","date":"2026-10-09","epss":0.00222,"percentile":0.11721}],"urls":["https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166","https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7","https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3","https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75805","description":"Issue summary: A CMP client that requests certificate revocation on the basis\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when\nprocessing a crafted revocation response. \n\nImpact summary: The NULL pointer dereference happens on a read which \nleads to a crash and a Denial of Service for the affected client application.\n\nCWE: CWE-476: NULL-pointer dereference\n\nDescription: A CMP client revoking a certificate has to tell the server which\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the\ncertificate itself or its issuer name and serial number. This is\n'openssl cmp -cmd rr -csr <file>' on the command line, or\nOSSL_CMP_exec_RR_ses() with the certificate supplied via\nOSSL_CMP_CTX_set1_p10CSR() through the API.\n\nA CSR does not contain the issuer name and serial number of the certificate,\nso the client does not send them. A server may optionally name the\ncertificate it revoked in its response, and the client then compares that\nname against what it sent. Having sent neither an issuer name nor a serial\nnumber, it has nothing to compare against, and a server returning a specially\ncrafted name causes the client to read from a NULL pointer and crash.\n\nThe revocation response is checked for valid message protection before\nthe affected code is reached, so an attacker must be a malicious or\ncompromised CMP server, or a man-in-the-middle in possession of the\nsecret used for message protection. Clients that identify the certificate\nto be revoked by a certificate or by issuer and serial number rather\nthan by a PKCS#10 CSR are not affected.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35191","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-35191","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35191","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35191","date":"2026-10-09","epss":0.00357,"percentile":0.27442}],"risk":0.11959499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-35191","description":"A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service (DoS) attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to calculate credit limits incorrectly by adding the total datagram size for each packet. Consequently, the server exceeds standard rate limits and transmits excessive response data to spoofed target addresses."},"relatedVulnerabilities":[{"id":"CVE-2026-35191","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35191","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35191","date":"2026-10-09","epss":0.00357,"percentile":0.27442}],"urls":["https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239","https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5","https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35191","description":"Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL's QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack.  If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-09","epss":0.00156,"percentile":0.04174}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33948","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-33948","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":3.8,"impactScore":1.5,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33948","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33948","cwe":"CWE-170","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33948","date":"2026-10-09","epss":0.00349,"percentile":0.26439}],"risk":0.11865999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-33948","description":"A flaw was found in jq, a command-line JSON processor. This vulnerability allows a remote attacker to bypass input validation by crafting malicious JSON input containing embedded null (NUL) bytes. Due to incorrect handling of input buffer lengths, jq truncates the input at the first NUL byte, validating only the benign prefix and silently discarding any malicious data that follows. This can lead to parser differential attacks where downstream systems, relying on jq for validation, may process the full, unvalidated input, potentially leading to unexpected behavior or security compromises."},"relatedVulnerabilities":[{"id":"CVE-2026-33948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33948","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33948","cwe":"CWE-170","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33948","date":"2026-10-09","epss":0.00349,"percentile":0.26439}],"urls":["https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b","https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33948","description":"jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-09","epss":0.00197,"percentile":0.08577}],"risk":0.11819999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-09","epss":0.00197,"percentile":0.08577}],"urls":["https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-09","epss":0.00197,"percentile":0.08577}],"risk":0.11819999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-09","epss":0.00197,"percentile":0.08577}],"urls":["https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-09","epss":0.00349,"percentile":0.26488}],"risk":0.11691499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6276","description":"A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom `Host:` header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new `Host:` header. This can lead to libcurl incorrectly sending cookies intended for the first host to the second host, resulting in a cookie leak. This issue is categorized as an Origin Validation Error (CWE-346). Exploitation typically requires specific debugging configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-6276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-09","epss":0.00349,"percentile":0.26488}],"urls":["https://curl.se/docs/CVE-2026-6276.html","https://curl.se/docs/CVE-2026-6276.json","https://hackerone.com/reports/3671818","http://www.openwall.com/lists/oss-security/2026/04/29/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-09","epss":0.00349,"percentile":0.26488}],"risk":0.11691499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6276","description":"A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom `Host:` header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new `Host:` header. This can lead to libcurl incorrectly sending cookies intended for the first host to the second host, resulting in a cookie leak. This issue is categorized as an Origin Validation Error (CWE-346). Exploitation typically requires specific debugging configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-6276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-09","epss":0.00349,"percentile":0.26488}],"urls":["https://curl.se/docs/CVE-2026-6276.html","https://curl.se/docs/CVE-2026-6276.json","https://hackerone.com/reports/3671818","http://www.openwall.com/lists/oss-security/2026/04/29/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84233","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-09","epss":0.00194,"percentile":0.08319}],"risk":0.1164,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-09","epss":0.00194,"percentile":0.08319}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84233","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-09","epss":0.00194,"percentile":0.08319}],"risk":0.1164,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-09","epss":0.00194,"percentile":0.08319}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"a3fc973d5d02135f","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-343h-94h5-c4wr","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-343h-94h5-c4wr","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-10-09","epss":0.00339,"percentile":0.25267}],"risk":0.11356499999999997,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr","https://nvd.nist.gov/vuln/detail/CVE-2026-106449","https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-343h-94h5-c4wr","description":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"},"relatedVulnerabilities":[{"id":"CVE-2026-106449","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-10-09","epss":0.00339,"percentile":0.25267}],"urls":["https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"10083edcbc977dbf","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-58261","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-58261","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58261","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58261","date":"2026-10-09","epss":0.00375,"percentile":0.29433}],"risk":0.11062499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-58261","description":"A flaw was found in sequoia-openpgp. Processing RawCertParser operations with unsupported primary key types triggers an infinite loop of error messages. This flaw allows a local attacker to provide a specially crafted certificate file, resulting in a denial of service due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2024-58261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58261","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58261","date":"2026-10-09","epss":0.00375,"percentile":0.29433}],"urls":["https://crates.io/crates/sequoia-openpgp","https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106","https://rustsec.org/advisories/RUSTSEC-2024-0345.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-58261","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type."}]},{"artifact":{"id":"10083edcbc977dbf","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-53161","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-53161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53161","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53161","date":"2026-10-09","epss":0.00345,"percentile":0.25984}],"risk":0.10867499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-53161","description":"A flaw was found in buffered-reader. The crate's implementation contains an out-of-bounds array access, leading to a panic. A local attacker can trigger this condition by providing a specially crafted input. This occurs when processing data from an external source, which can result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-53161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53161","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53161","date":"2026-10-09","epss":0.00345,"percentile":0.25984}],"urls":["https://crates.io/crates/buffered-reader","https://github.com/advisories/GHSA-29mf-62xx-28jq","https://gitlab.com/sequoia-pgp/sequoia/-/tags/buffered-reader%2Fv1.0.2","https://gitlab.com/sequoia-pgp/sequoia/-/tags/buffered-reader%2Fv1.1.5","https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/","https://rustsec.org/advisories/RUSTSEC-2023-0039.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-53161","description":"The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-1632","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1632","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-10-09","epss":0.00342,"percentile":0.25698}],"risk":0.10772999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1632","description":"A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior. This bug does not compromise the integrity or availability of the base system."},"relatedVulnerabilities":[{"id":"CVE-2025-1632","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-10-09","epss":0.00342,"percentile":0.25698}],"urls":["https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc","https://vuldb.com/?ctiid.296619","https://vuldb.com/?id.296619","https://vuldb.com/?submit.496460"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31789","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-31789","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-10-09","epss":0.00243,"percentile":0.14271}],"risk":0.10691999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-31789","description":"A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment."},"relatedVulnerabilities":[{"id":"CVE-2026-31789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-10-09","epss":0.00243,"percentile":0.14271}],"urls":["https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde","https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf","https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49","https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9","https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","description":"Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"0af166639c23f346","cpes":["cpe:2.3:a:libusb1:libusb1:1.0.30-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libusb1:1.0.30-1.el10_2:*:*:*:*:*:*:*"],"name":"libusb1","purl":"pkg:rpm/redhat/libusb1@1.0.30-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libusb1-1.0.30-1.el10_2.src.rpm","type":"rpm","version":"1.0.30-1.el10_2","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-23679","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libusb1","version":"0:1.0.30-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-23679","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23679","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-23679","date":"2026-10-09","epss":0.00184,"percentile":0.07368}],"risk":0.10304,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-23679","description":"A flaw was found in libusb. An attacker can provide a specially crafted Universal Serial Bus (USB) configuration descriptor to applications using libusb. This malformed descriptor can lead to a null pointer dereference, causing the application to crash and resulting in a denial of service. This vulnerability can be exploited via virtualized USB passthrough, file-based descriptor parsing, or network sources."},"relatedVulnerabilities":[{"id":"CVE-2026-23679","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23679","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-23679","date":"2026-10-09","epss":0.00184,"percentile":0.07368}],"urls":["https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704","https://github.com/libusb/libusb/issues/1813","https://github.com/libusb/libusb/pull/1814","https://github.com/libusb/libusb/releases/tag/v1.0.30","https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23679","description":"libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash."}]},{"artifact":{"id":"0af166639c23f346","cpes":["cpe:2.3:a:libusb1:libusb1:1.0.30-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libusb1:1.0.30-1.el10_2:*:*:*:*:*:*:*"],"name":"libusb1","purl":"pkg:rpm/redhat/libusb1@1.0.30-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libusb1-1.0.30-1.el10_2.src.rpm","type":"rpm","version":"1.0.30-1.el10_2","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-47104","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libusb1","version":"0:1.0.30-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-47104","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47104","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-47104","date":"2026-10-09","epss":0.0019,"percentile":0.07917}],"risk":0.09975,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-47104","description":"A flaw was found in libusb. This out-of-bounds read vulnerability allows a local attacker, particularly in virtualized environments utilizing USB passthrough, to trigger a denial of service. By providing a malformed USB descriptor, the attacker can cause the software to read beyond its allocated memory, leading to system instability or crashes."},"relatedVulnerabilities":[{"id":"CVE-2026-47104","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47104","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-47104","date":"2026-10-09","epss":0.0019,"percentile":0.07917}],"urls":["https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704","https://github.com/libusb/libusb/issues/1813","https://github.com/libusb/libusb/pull/1814","https://github.com/libusb/libusb/releases/tag/v1.0.30","https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47104","description":"libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-09","epss":0.00168,"percentile":0.05639}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-70873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-70873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-10-09","epss":0.00313,"percentile":0.22226}],"risk":0.09859499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-70873","description":"A flaw was found in SQLite. This information disclosure vulnerability exists within the zipfile extension, specifically in the zipfileInflate function. A remote attacker could exploit this by providing a specially crafted ZIP file. Successful exploitation could lead to the disclosure of sensitive heap memory information."},"relatedVulnerabilities":[{"id":"CVE-2025-70873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-10-09","epss":0.00313,"percentile":0.22226}],"urls":["https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054","https://sqlite.org/forum/forumpost/761eac3c82","https://sqlite.org/src/info/3d459f1fb1bd1b5e"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33947","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-33947","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33947","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33947","date":"2026-10-09","epss":0.00176,"percentile":0.06582}],"risk":0.09856000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-33947","description":"A flaw was found in jq, a command line JSON processor. Processing a crafted JSON document, specifically when a large array is used as a path argument to the `jv_setpath`, `jv_getpath` and `delpaths_sorted` functions can lead to an uncontrolled recursion and exhausts the call stack, causing an application crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-33947","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33947","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33947","date":"2026-10-09","epss":0.00176,"percentile":0.06582}],"urls":["https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f","https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg","http://www.openwall.com/lists/oss-security/2026/04/16/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33947","description":"jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87876","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-87876","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-09","epss":0.00328,"percentile":0.23879}],"risk":0.09839999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-87876","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-09","epss":0.00328,"percentile":0.23879}],"urls":["https://access.redhat.com/errata/RHSA-2026:67568","https://access.redhat.com/security/cve/CVE-2026-87876","https://bugzilla.redhat.com/show_bug.cgi?id=2530991","https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8","https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87876","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-87876","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-09","epss":0.00328,"percentile":0.23879}],"risk":0.09839999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-87876","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-09","epss":0.00328,"percentile":0.23879}],"urls":["https://access.redhat.com/errata/RHSA-2026:67568","https://access.redhat.com/security/cve/CVE-2026-87876","https://bugzilla.redhat.com/show_bug.cgi?id=2530991","https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8","https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."}]},{"artifact":{"id":"26333e82a7f1194a","cpes":["cpe:2.3:a:redhat:glibc:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-09","epss":0.00292,"percentile":0.19953}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-09","epss":0.00292,"percentile":0.19953}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"a69a465221b314ff","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-09","epss":0.00292,"percentile":0.19953}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-09","epss":0.00292,"percentile":0.19953}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"75ec3abb14d3aef9","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-09","epss":0.00292,"percentile":0.19953}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-09","epss":0.00292,"percentile":0.19953}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49839","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-49839","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49839","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49839","date":"2026-10-09","epss":0.00165,"percentile":0.05207}],"risk":0.0957,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-49839","description":"A flaw was found in jq, a command-line JSON processor. This vulnerability allows an attacker to trigger a heap out-of-bounds write by providing a specially crafted, oversized file to the `jq --rawfile` option. This can lead to a denial of service (DoS), making the affected system or application unavailable, and may also impact data integrity. Exploitation requires user interaction, as a user must process the malicious file."},"relatedVulnerabilities":[{"id":"CVE-2026-49839","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49839","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49839","date":"2026-10-09","epss":0.00165,"percentile":0.05207}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49839","description":"jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg(\"String too long\"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2."}]},{"artifact":{"id":"62d317a34f380a43","cpes":["cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:rpm/redhat/alsa-lib@1.2.15.3-2.el10?arch=x86_64&distro=rhel-10.2&upstream=alsa-lib-1.2.15.3-2.el10.src.rpm","type":"rpm","version":"1.2.15.3-2.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-90781","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"alsa-lib","version":"0:1.2.15.3-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-09","epss":0.0017,"percentile":0.05841}],"risk":0.09434999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-90781","description":"A flaw was found in alsa-lib. This vulnerability is an off-by-one stack buffer overflow in the `__snd_ctl_ascii_elem_id_parse()` function. A local attacker can exploit this by supplying a specially crafted, long control-element identifier string through saved state files or command-line arguments. This can cause the application to write one byte past a 64-byte buffer, leading to adjacent stack memory corruption and a crash of the calling process, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-90781","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-09","epss":0.0017,"percentile":0.05841}],"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."}]},{"artifact":{"id":"cfb8d2e6f3a53be0","cpes":["cpe:2.3:a:avahi-libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi-libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*"],"name":"avahi-libs","purl":"pkg:rpm/redhat/avahi-libs@0.9~rc2-2.el10?arch=x86_64&distro=rhel-10.2&upstream=avahi-0.9~rc2-2.el10.src.rpm","type":"rpm","version":"0.9~rc2-2.el10","language":"","licenses":["LGPL-2.1-or-later AND LGPL-2.0-or-later AND BSD-2-Clause-Views AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"avahi","version":"0.9~rc2-2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59529","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"avahi","version":"0.9~rc2-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-59529","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-09","epss":0.00179,"percentile":0.06834}],"risk":0.093975,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-59529","description":"A flaw was found in avahi. The simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2025-59529","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-09","epss":0.00179,"percentile":0.06834}],"urls":["https://github.com/avahi/avahi/pull/808","https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q","https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529","http://www.openwall.com/lists/oss-security/2025/12/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59529","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-09","epss":0.00126,"percentile":0.02039}],"risk":0.09387,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89161","description":"A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code."},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-09","epss":0.00126,"percentile":0.02039}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-09","epss":0.00126,"percentile":0.02039}],"risk":0.09387,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89161","description":"A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code."},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-09","epss":0.00126,"percentile":0.02039}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.2,"impactScore":2.8,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34990","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34990","date":"2026-10-09","epss":0.00182,"percentile":0.07183}],"risk":0.09282,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34990","description":"A flaw was found in OpenPrinting CUPS. A local unprivileged user can exploit this vulnerability by coercing the `cupsd` service to authenticate to an attacker-controlled Internet Printing Protocol (IPP) service. This allows the user to create a persistent printer queue that can overwrite arbitrary files with root privileges. Successful exploitation can lead to privilege escalation and arbitrary root command execution."},"relatedVulnerabilities":[{"id":"CVE-2026-34990","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34990","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34990","date":"2026-10-09","epss":0.00182,"percentile":0.07183}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34990","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.2,"impactScore":2.8,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34990","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34990","date":"2026-10-09","epss":0.00182,"percentile":0.07183}],"risk":0.09282,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34990","description":"A flaw was found in OpenPrinting CUPS. A local unprivileged user can exploit this vulnerability by coercing the `cupsd` service to authenticate to an attacker-controlled Internet Printing Protocol (IPP) service. This allows the user to create a persistent printer queue that can overwrite arbitrary files with root privileges. Successful exploitation can lead to privilege escalation and arbitrary root command execution."},"relatedVulnerabilities":[{"id":"CVE-2026-34990","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34990","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34990","date":"2026-10-09","epss":0.00182,"percentile":0.07183}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34990","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-09","epss":0.00144,"percentile":0.03195}],"risk":0.09216,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-09","epss":0.00144,"percentile":0.03195}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-09","epss":0.00144,"percentile":0.03195}],"risk":0.09216,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-09","epss":0.00144,"percentile":0.03195}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5915","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5915","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5915","date":"2026-10-09","epss":0.00192,"percentile":0.08147}],"risk":0.09215999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5915","description":"A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions."},"relatedVulnerabilities":[{"id":"CVE-2025-5915","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5915","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5915","date":"2026-10-09","epss":0.00192,"percentile":0.08147}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5915","https://bugzilla.redhat.com/show_bug.cgi?id=2370865","https://github.com/libarchive/libarchive/pull/2599","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5915","description":"A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions."}]},{"artifact":{"id":"62d317a34f380a43","cpes":["cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:rpm/redhat/alsa-lib@1.2.15.3-2.el10?arch=x86_64&distro=rhel-10.2&upstream=alsa-lib-1.2.15.3-2.el10.src.rpm","type":"rpm","version":"1.2.15.3-2.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25068","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"alsa-lib","version":"0:1.2.15.3-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-25068","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25068","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-25068","date":"2026-10-09","epss":0.00198,"percentile":0.0884}],"risk":0.09206999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-25068","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-25068","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25068","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-25068","date":"2026-10-09","epss":0.00198,"percentile":0.0884}],"urls":["https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40","https://www.vulncheck.com/advisories/alsa-lib-topology-decoder-heap-based-buffer-overflow","https://lists.debian.org/debian-lts-announce/2026/02/msg00008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25068","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-39956","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-39956","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39956","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-39956","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-39956","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39956","date":"2026-10-09","epss":0.00165,"percentile":0.05182}],"risk":0.09157499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-39956","description":"A flaw was found in jq, a command line JSON processor. In release builds, the `_strindices` builtin function calls the `jv_string_indexes` function without checking that the arguments are actually strings. This missing validation allows an attacker who can supply non-string inputs to cause an application crash and a limited memory read."},"relatedVulnerabilities":[{"id":"CVE-2026-39956","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39956","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-39956","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-39956","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39956","date":"2026-10-09","epss":0.00165,"percentile":0.05182}],"urls":["https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03","https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39956","description":"jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95512","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95512","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95512","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95512","date":"2026-10-09","epss":0.00174,"percentile":0.06281}],"risk":0.09135,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95512","description":"A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-95512","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95512","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95512","date":"2026-10-09","epss":0.00174,"percentile":0.06281}],"urls":["https://access.redhat.com/errata/RHSA-2026:74952","https://access.redhat.com/security/cve/CVE-2026-95512","https://bugzilla.redhat.com/show_bug.cgi?id=2462295","https://gitlab.freedesktop.org/freetype/freetype/-/commit/f3ca71c9900fe860849b3163a6e2c1e765b291d9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95512","description":"A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate."}]},{"artifact":{"id":"e1f68ab5ba7614fd","cpes":["cpe:2.3:a:bzip2-libs:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2-libs:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2_libs:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2_libs:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*"],"name":"bzip2-libs","purl":"pkg:rpm/redhat/bzip2-libs@1.0.8-25.el10?arch=x86_64&distro=rhel-10.2&upstream=bzip2-1.0.8-25.el10.src.rpm","type":"rpm","version":"1.0.8-25.el10","language":"","licenses":["BSD-4-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bzip2","version":"1.0.8-25.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42250","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bzip2","version":"1.0.8-25.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-10-09","epss":0.00182,"percentile":0.07183}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42250","description":"A flaw was found in bzip2. The bzip2recover utility contains an off-by-one error that allows a local attacker to cause an out-of-bounds write to a global buffer by processing a specially crafted file. This memory corruption can lead to a crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-42250","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-10-09","epss":0.00182,"percentile":0.07183}],"urls":["https://cert.pl/en/posts/2026/05/CVE-2026-42250/","https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/","https://sourceware.org/bzip2/","https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-60753","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-60753","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-10-09","epss":0.00172,"percentile":0.06045}],"risk":0.0903,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-60753","description":"A vulnerability in apply_substitution() function in libarchive's bsdtar allows crafted -s substitution rules to repeatedly match a zero-length substring and append replacements without advancing the input pointer. When the rule uses the global /g flag (or an explicitly empty pattern), this leads to unbounded output allocation and eventual process OOM (Denial of Service). Upgrade to libarchive 3.8.1 or apply a patch that prevents zero-length match loops or rejects empty patterns."},"relatedVulnerabilities":[{"id":"CVE-2025-60753","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-10-09","epss":0.00172,"percentile":0.06045}],"urls":["https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753","https://github.com/libarchive/libarchive/issues/2725"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60753","description":"An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash)."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-64505","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-64505","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64505","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64505","date":"2026-10-09","epss":0.00192,"percentile":0.08093}],"risk":0.09024,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-64505","description":"A heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access."},"relatedVulnerabilities":[{"id":"CVE-2025-64505","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64505","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64505","date":"2026-10-09","epss":0.00192,"percentile":0.08093}],"urls":["https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37","https://github.com/pnggroup/libpng/pull/748","https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64505","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-09","epss":0.00268,"percentile":0.1736}],"risk":0.08978,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89160","description":"A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-09","epss":0.00268,"percentile":0.1736}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-09","epss":0.00268,"percentile":0.1736}],"risk":0.08978,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89160","description":"A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-09","epss":0.00268,"percentile":0.1736}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5745","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5745","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5745","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5745","date":"2026-10-09","epss":0.00171,"percentile":0.05963}],"risk":0.089775,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5745","description":"A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-5745","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5745","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5745","date":"2026-10-09","epss":0.00171,"percentile":0.05963}],"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-5745","https://bugzilla.redhat.com/show_bug.cgi?id=2455921"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5745","description":"A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS)."}]},{"artifact":{"id":"10083edcbc977dbf","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-53160","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-53160","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53160","date":"2026-10-09","epss":0.00285,"percentile":0.19303}],"risk":0.089775,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-53160","description":"A flaw was found in sequoia-openpgp. The crate exhibits an out-of-bounds array access, leading to a panic during processing. A local attacker can trigger this condition by providing a specially crafted input, which results in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-53160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53160","date":"2026-10-09","epss":0.00285,"percentile":0.19303}],"urls":["https://crates.io/crates/sequoia-openpgp","https://github.com/advisories/GHSA-25mx-8f3v-8wh7","https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/","https://rustsec.org/advisories/RUSTSEC-2023-0038.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-53160","description":"The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic."}]},{"artifact":{"id":"001b53ddb1443472","cpes":["cpe:2.3:a:openldap:openldap:2.6.10-1.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openldap:2.6.10-1.el10:*:*:*:*:*:*:*"],"name":"openldap","purl":"pkg:rpm/redhat/openldap@2.6.10-1.el10?arch=x86_64&distro=rhel-10.2&upstream=openldap-2.6.10-1.el10.src.rpm","type":"rpm","version":"2.6.10-1.el10","language":"","licenses":["OLDAP-2.8"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-22185","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openldap","version":"0:2.6.10-1.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-22185","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22185","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-22185","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-22185","date":"2026-10-09","epss":0.00152,"percentile":0.03816}],"risk":0.08968,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-22185","description":"A flaw was found in OpenLDAP Lightning Memory-Mapped Database (LMDB) mdb_load. When processing malformed input, a local attacker can exploit a heap buffer underflow vulnerability in the readline() function. This can lead to an out-of-bounds read, potentially causing a denial of service (DoS) and limited disclosure of heap memory contents."},"relatedVulnerabilities":[{"id":"CVE-2026-22185","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22185","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-22185","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-22185","date":"2026-10-09","epss":0.00152,"percentile":0.03816}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=10421","https://seclists.org/fulldisclosure/2026/Jan/5","https://seclists.org/fulldisclosure/2026/Jan/8","https://www.openldap.org/","https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22185","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35189","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-09","epss":0.00267,"percentile":0.173}],"risk":0.089445,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-35189","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by presenting a specially crafted certificate during a Transport Layer Security (TLS) handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List (CRL) distribution points, it allocates an excessive amount of memory. This disproportionate memory usage can exhaust system resources and crash the affected client or server application."},"relatedVulnerabilities":[{"id":"CVE-2026-35189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-09","epss":0.00267,"percentile":0.173}],"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"bc38c5eb112b7517","cpes":["cpe:2.3:a:redhat:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.24.5-8.el10_2:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=x86_64&distro=rhel-10.2&upstream=wget-1.24.5-8.el10_2.src.rpm","type":"rpm","version":"1.24.5-8.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later AND GFDL-1.3-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15146","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"wget","version":"0:1.24.5-8.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-15146","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15146","date":"2026-10-09","epss":0.00164,"percentile":0.05158}],"risk":0.08938,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15146","description":"A flaw was found in Wget. When operating in FTP passive mode, Wget fails to validate the IP address provided in an FTP PASV response. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this vulnerability to redirect Wget's data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially leading to unauthorized access to localhost services or internal network resources."},"relatedVulnerabilities":[{"id":"CVE-2026-15146","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15146","date":"2026-10-09","epss":0.00164,"percentile":0.05158}],"urls":["https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b","https://kb.cert.org/vuls/id/564823","https://www.kb.cert.org/vuls/id/564823"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15146","description":"GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-39804","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-39804","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39804","date":"2026-10-09","epss":0.00283,"percentile":0.1906}],"risk":0.08914499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-39804","description":"A flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-39804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39804","date":"2026-10-09","epss":0.00283,"percentile":0.1906}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079","https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4","https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723","https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88648","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-88648","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-88648","date":"2026-10-09","epss":0.00117,"percentile":0.01557}],"risk":0.087165,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-88648","description":"A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority (CA) can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure (PKI) restrictions. This allows unauthorized certificates to be accepted as valid, potentially enabling the attacker to impersonate trusted domains and intercept secure communications."},"relatedVulnerabilities":[{"id":"CVE-2026-88648","cvss":[],"epss":[{"cve":"CVE-2026-88648","date":"2026-10-09","epss":0.00117,"percentile":0.01557}],"urls":["https://gist.github.com/lkloliver/1f2a97cb8d0b31aa27b6bd0354358d7d","https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10","https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88648","description":"Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates."}]},{"artifact":{"id":"a180667717d94fe1","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"257-23.el10_2.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-09","epss":0.00149,"percentile":0.03575}],"risk":0.08716499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-09","epss":0.00149,"percentile":0.03575}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-09","epss":0.00294,"percentile":0.20187}],"risk":0.08672999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89156","description":"A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-09","epss":0.00294,"percentile":0.20187}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-09","epss":0.00294,"percentile":0.20187}],"risk":0.08672999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89156","description":"A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-09","epss":0.00294,"percentile":0.20187}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53655","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53655","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53655","date":"2026-10-09","epss":0.00156,"percentile":0.0423}],"risk":0.08657999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53655","description":"A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to other standard tar implementations. A remote attacker could exploit this by crafting a malicious archive, causing different interpretations of archive contents between node-tar and other tools. This could allow an attacker to hide malicious files or sensitive information from security scanners that rely on different tar parsing libraries, potentially leading to information disclosure or bypassing security controls."},"relatedVulnerabilities":[{"id":"CVE-2026-53655","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53655","date":"2026-10-09","epss":0.00156,"percentile":0.0423}],"urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-43894","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-43894","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43894","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-43894","date":"2026-10-09","epss":0.00153,"percentile":0.03922}],"risk":0.08568,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-43894","description":"A flaw was found in jq, a tool used for processing JSON data from the command line. A remote attacker can exploit a vulnerability by providing a specially crafted large number as input. This can cause an internal calculation error, leading to a memory overflow where the attacker can write their own data into the system's memory, potentially resulting in the application crashing (Denial of Service)."},"relatedVulnerabilities":[{"id":"CVE-2026-43894","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43894","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-43894","date":"2026-10-09","epss":0.00153,"percentile":0.03922}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43894","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit)."}]},{"artifact":{"id":"4c587e26eda1e82b","cpes":["cpe:2.3:a:libsolv:libsolv:0.7.33-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsolv:0.7.33-5.el10_2:*:*:*:*:*:*:*"],"name":"libsolv","purl":"pkg:rpm/redhat/libsolv@0.7.33-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libsolv-0.7.33-5.el10_2.src.rpm","type":"rpm","version":"0.7.33-5.el10_2","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82327","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libsolv","version":"0:0.7.33-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-82327","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82327","cwe":"CWE-129","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-82327","date":"2026-10-09","epss":0.00163,"percentile":0.04996}],"risk":0.085575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82327","description":"A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value."},"relatedVulnerabilities":[{"id":"CVE-2026-82327","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82327","cwe":"CWE-129","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-82327","date":"2026-10-09","epss":0.00163,"percentile":0.04996}],"urls":["https://access.redhat.com/security/cve/CVE-2026-82327","https://bugzilla.redhat.com/show_bug.cgi?id=2525602"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82327","description":"A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value."}]},{"artifact":{"id":"cfb8d2e6f3a53be0","cpes":["cpe:2.3:a:avahi-libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi-libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*"],"name":"avahi-libs","purl":"pkg:rpm/redhat/avahi-libs@0.9~rc2-2.el10?arch=x86_64&distro=rhel-10.2&upstream=avahi-0.9~rc2-2.el10.src.rpm","type":"rpm","version":"0.9~rc2-2.el10","language":"","licenses":["LGPL-2.1-or-later AND LGPL-2.0-or-later AND BSD-2-Clause-Views AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"avahi","version":"0.9~rc2-2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34933","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"avahi","version":"0.9~rc2-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34933","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-09","epss":0.00161,"percentile":0.04759}],"risk":0.084525,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34933","description":"A flaw was found in Avahi. An unprivileged local user can exploit this vulnerability by sending a D-Bus method call with conflicting publish flags. This can lead to a denial of service (DoS) by crashing the avahi-daemon, making the service unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-34933","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-09","epss":0.00161,"percentile":0.04759}],"urls":["https://github.com/avahi/avahi/commit/625ca0fac19229f6dfa3a6c6b698ae657187e50c","https://github.com/avahi/avahi/pull/891","https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc","http://www.openwall.com/lists/oss-security/2026/04/11/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34933","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50812","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-50812","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-09","epss":0.0016,"percentile":0.04595}],"risk":0.084,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-50812","description":"A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-50812","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-09","epss":0.0016,"percentile":0.04595}],"urls":["https://gist.github.com/junius-sec/bb556f333957c5226dede314db0e9e91","https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb1383549f2a18aa35508385d","https://sqlite.org/src/info/e807d4e3798efd53"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50812","description":"A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer."}]},{"artifact":{"id":"a180667717d94fe1","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"257-23.el10_2.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-09","epss":0.00159,"percentile":0.04486}],"risk":0.08347500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-09","epss":0.00159,"percentile":0.04486}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41256","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-41256","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41256","cwe":"CWE-158","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41256","date":"2026-10-09","epss":0.00157,"percentile":0.04317}],"risk":0.082425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41256","description":"A flaw was found in jq, a command line JSON processor. Top-level jq programs loaded from a file using the `-f` flag are truncated at the first embedded NUL byte. This issue allows an attacker who can supply a crafted filter file to prematurely truncate the program, potentially bypassing filtering logic and modifying the integrity of the processed data."},"relatedVulnerabilities":[{"id":"CVE-2026-41256","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41256","cwe":"CWE-158","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41256","date":"2026-10-09","epss":0.00157,"percentile":0.04317}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41256","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88647","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-88647","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-88647","date":"2026-10-09","epss":0.0011,"percentile":0.01194}],"risk":0.08195000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-88647","description":"A flaw was found in GnuTLS. This vulnerability can lead to information disclosure by allowing an attacker to bypass certificate hostname verification. A remote attacker presenting a crafted certificate can circumvent the Common Name fallback check, enabling them to eavesdrop on or intercept encrypted network communications."},"relatedVulnerabilities":[{"id":"CVE-2026-88647","cvss":[],"epss":[{"cve":"CVE-2026-88647","date":"2026-10-09","epss":0.0011,"percentile":0.01194}],"urls":["https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642","https://gitlab.com/gnutls/gnutls/-/issues/1802"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","description":"A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39316","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-39316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39316","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39316","date":"2026-10-09","epss":0.00182,"percentile":0.07149}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-39316","description":"A flaw was found in CUPS, an open-source printing system. This vulnerability, known as a use-after-free, occurs in the CUPS scheduler when temporary printers are automatically removed. The system fails to properly manage memory, leaving a pointer to a freed memory location. An attacker could exploit this to cause the CUPS daemon to crash, leading to a denial of service. In more severe scenarios, this could potentially allow an attacker to execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-39316","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39316","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39316","date":"2026-10-09","epss":0.00182,"percentile":0.07149}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39316","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39316","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-39316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39316","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39316","date":"2026-10-09","epss":0.00182,"percentile":0.07149}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-39316","description":"A flaw was found in CUPS, an open-source printing system. This vulnerability, known as a use-after-free, occurs in the CUPS scheduler when temporary printers are automatically removed. The system fails to properly manage memory, leaving a pointer to a freed memory location. An attacker could exploit this to cause the CUPS daemon to crash, leading to a denial of service. In more severe scenarios, this could potentially allow an attacker to execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-39316","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39316","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39316","date":"2026-10-09","epss":0.00182,"percentile":0.07149}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39316","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution."}]},{"artifact":{"id":"cfb8d2e6f3a53be0","cpes":["cpe:2.3:a:avahi-libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi-libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi_libs:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi-libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:avahi:avahi_libs:0.9\\~rc2-2.el10:*:*:*:*:*:*:*"],"name":"avahi-libs","purl":"pkg:rpm/redhat/avahi-libs@0.9~rc2-2.el10?arch=x86_64&distro=rhel-10.2&upstream=avahi-0.9~rc2-2.el10.src.rpm","type":"rpm","version":"0.9~rc2-2.el10","language":"","licenses":["LGPL-2.1-or-later AND LGPL-2.0-or-later AND BSD-2-Clause-Views AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"avahi","version":"0.9~rc2-2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"avahi","version":"0.9~rc2-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-68276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-09","epss":0.00156,"percentile":0.04208}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-68276","description":"A flaw was found in Avahi, a system that facilitates service discovery on a local network. An unprivileged local user can exploit this vulnerability by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can lead to a Denial of Service (DoS) by crashing the avahi-daemon, making the service unavailable."},"relatedVulnerabilities":[{"id":"CVE-2025-68276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-09","epss":0.00156,"percentile":0.04208}],"urls":["https://github.com/avahi/avahi/commit/ede7048475c5d47d53890e3bc1350dda8e0b3688","https://github.com/avahi/avahi/pull/806","https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68276","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling\nthe RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-40612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-40612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40612","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-40612","date":"2026-10-09","epss":0.00156,"percentile":0.04207}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-40612","description":"A flaw was found in jq, a command line JSON processor. The `jv_contains` function does not have a depth limit when processing nested arrays or objects. This missing depth limit allows an attacker who can supply a sufficiently nested input structure to exhaust the stack memory, causing an application crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-40612","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40612","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-40612","date":"2026-10-09","epss":0.00156,"percentile":0.04207}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-r7m6-x9c7-h69j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40612","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-44777","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44777","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44777","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44777","date":"2026-10-09","epss":0.00156,"percentile":0.04207}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44777","description":"A flaw was found in jq, a command line JSON processor. The module loader fails to perform cycle detection when resolving imports. This missing cycle detection allows an attacker who can supply crafted modules with circular dependencies to exhaust the stack memory, causing an application crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-44777","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44777","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44777","date":"2026-10-09","epss":0.00156,"percentile":0.04207}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44777","description":"jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-47770","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-47770","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47770","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47770","date":"2026-10-09","epss":0.00156,"percentile":0.04207}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-47770","description":"A flaw was found in jq, a command-line JSON processor. This vulnerability allows a local user or an attacker providing malicious input to cause a denial of service (DoS) by comparing two sufficiently deeply nested arrays using the '==' operator. This action exhausts the C stack due to uncontrolled recursion, leading to a crash of the jq process."},"relatedVulnerabilities":[{"id":"CVE-2026-47770","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47770","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47770","date":"2026-10-09","epss":0.00156,"percentile":0.04207}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47770","description":"jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from  the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context  where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2."}]},{"artifact":{"id":"62d317a34f380a43","cpes":["cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:rpm/redhat/alsa-lib@1.2.15.3-2.el10?arch=x86_64&distro=rhel-10.2&upstream=alsa-lib-1.2.15.3-2.el10.src.rpm","type":"rpm","version":"1.2.15.3-2.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56109","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"alsa-lib","version":"0:1.2.15.3-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56109","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-10-09","epss":0.00138,"percentile":0.0278}],"risk":0.08141999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56109","description":"A flaw was found in the ALSA (Advanced Linux Sound Architecture) library. This double-free vulnerability, located in the `parse_def()` function, allows a local attacker to corrupt memory by providing specially crafted ALSA configuration text. When processing nested configuration blocks, the library attempts to free an already freed memory node. This can lead to system instability, crashes, or a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-56109","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-10-09","epss":0.00138,"percentile":0.0278}],"urls":["https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-28164","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-28164","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-28164","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-28164","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-28164","date":"2026-10-09","epss":0.00162,"percentile":0.04906}],"risk":0.08099999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-28164","description":"A flaw was found in libpng. This buffer overflow vulnerability allows a local attacker to cause a denial of service (DoS) by exploiting the `png_create_read_struct()` function. This can lead to the affected system becoming unresponsive or crashing."},"relatedVulnerabilities":[{"id":"CVE-2025-28164","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-28164","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-28164","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-28164","date":"2026-10-09","epss":0.00162,"percentile":0.04906}],"urls":["https://gist.github.com/kittener/506516f8c22178005b4379c8b2a7de20","https://github.com/pnggroup/libpng/issues/655"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-28164","description":"Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-43896","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-43896","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43896","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-43896","date":"2026-10-09","epss":0.0015,"percentile":0.03648}],"risk":0.07875,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-43896","description":"A flaw was found in jq, a command line JSON processor. The `jv_object_merge_recursive` function, reachable via the `*` operator when both operands are objects, does not have a depth limit when processing nested objects. This missing depth limit allows an attacker who can supply a sufficiently nested input structure to exhaust the stack memory, causing an application crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-43896","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43896","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-43896","date":"2026-10-09","epss":0.0015,"percentile":0.03648}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43896","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75803","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-09","epss":0.00232,"percentile":0.12889}],"risk":0.07772,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75803","description":"A flaw in OpenSSL causes EVP_Cipher() to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid."},"relatedVulnerabilities":[{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-09","epss":0.00232,"percentile":0.12889}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"10083edcbc977dbf","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75803","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-09","epss":0.00232,"percentile":0.12889}],"risk":0.07772,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75803","description":"A flaw in OpenSSL causes EVP_Cipher() to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid."},"relatedVulnerabilities":[{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-09","epss":0.00232,"percentile":0.12889}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-64506","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-64506","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64506","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64506","date":"2026-10-09","epss":0.0014,"percentile":0.02893}],"risk":0.07769999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-64506","description":"A buffer over read flaw has been discovered in libpng. A heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries."},"relatedVulnerabilities":[{"id":"CVE-2025-64506","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64506","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64506","date":"2026-10-09","epss":0.0014,"percentile":0.02893}],"urls":["https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821","https://github.com/pnggroup/libpng/pull/749","https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64506","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51."}]},{"artifact":{"id":"3217cb7fb1163bcd","cpes":["cpe:2.3:a:redhat:sed:4.9-5.el10:*:*:*:*:*:*:*","cpe:2.3:a:sed:sed:4.9-5.el10:*:*:*:*:*:*:*"],"name":"sed","purl":"pkg:rpm/redhat/sed@4.9-5.el10?arch=x86_64&distro=rhel-10.2&upstream=sed-4.9-5.el10.src.rpm","type":"rpm","version":"4.9-5.el10","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5958","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sed","version":"0:4.9-5.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5958","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-10-09","epss":0.00137,"percentile":0.02726}],"risk":0.07740499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5958","description":"A Time-of-Check Time-of-Use (TOCTOU) race condition was found in GNU sed. When the -i (in-place) and --follow-symlinks options are used together, sed resolves the symlink but reopens the path for writing. An attacker with write access to the directory containing the symlink can swap it between the check and the open operations. If a privileged user executes sed in this manner on a path influenced by the attacker, it can lead to arbitrary file overwrites and potential privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-5958","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-10-09","epss":0.00137,"percentile":0.02726}],"urls":["https://cert.pl/en/posts/2026/04/CVE-2026-5958","https://www.gnu.org/software/sed/","http://www.openwall.com/lists/oss-security/2026/05/13/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5958","description":"When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores the resolved path for determining when output is written,\n2. opens the original symlink path (not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10."}]},{"artifact":{"id":"26333e82a7f1194a","cpes":["cpe:2.3:a:redhat:glibc:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-09","epss":0.00129,"percentile":0.02215}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-09","epss":0.00129,"percentile":0.02215}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"a69a465221b314ff","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-09","epss":0.00129,"percentile":0.02215}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-09","epss":0.00129,"percentile":0.02215}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"75ec3abb14d3aef9","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-09","epss":0.00129,"percentile":0.02215}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-09","epss":0.00129,"percentile":0.02215}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54679","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-54679","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54679","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54679","date":"2026-10-09","epss":0.00147,"percentile":0.03434}],"risk":0.077175,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54679","description":"A flaw was found in jq, a command-line JSON processor. On 32-bit systems, a local attacker could exploit an integer overflow vulnerability in the `jvp_string_append` function. This could lead to a massive buffer overrun, resulting in a denial of service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-54679","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54679","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54679","date":"2026-10-09","epss":0.00147,"percentile":0.03434}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54679","description":"jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun.  This vulnerability is fixed in 1.8.2."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34757","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-34757","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34757","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34757","date":"2026-10-09","epss":0.00163,"percentile":0.05061}],"risk":0.07661,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34757","description":"A flaw was found in libpng, a library used for handling PNG (Portable Network Graphics) image files. This vulnerability arises when an application reuses a pointer, previously obtained from functions like png_get_PLTE, by passing it back to a corresponding setter function within the same image structure. This action causes the setter to access memory that has already been deallocated, leading to a use-after-free condition. A local attacker could potentially exploit this flaw to corrupt image metadata or disclose sensitive information from the application's memory."},"relatedVulnerabilities":[{"id":"CVE-2026-34757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34757","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34757","date":"2026-10-09","epss":0.00163,"percentile":0.05061}],"urls":["https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a","https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc","https://github.com/pnggroup/libpng/issues/836","https://github.com/pnggroup/libpng/issues/837","https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645","https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34757","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57."}]},{"artifact":{"id":"0ae89b4b5494a2e0","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-2.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-2.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-2.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-2.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42771","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42771","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42771","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42771","date":"2026-10-09","epss":0.0016,"percentile":0.0467}],"risk":0.076,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42771","description":"A flaw was found in OpenSSL. When an application uses the X509_VERIFY_PARAM_set1_email() function to validate a specially crafted S/MIME (Secure/Multipurpose Internet Mail Extensions) email address, an out-of-bounds read can occur. A remote attacker could exploit this vulnerability by sending a malicious email, leading to an application crash and a Denial of Service (DoS). This issue does not directly expose sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-42771","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42771","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42771","date":"2026-10-09","epss":0.0016,"percentile":0.0467}],"urls":["https://github.com/openssl/openssl/commit/6cd187689f8180c1f8a3acde21f88190c4a20de7","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42771","description":"Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an\napplication to validate a crafted e-mail address, such as during S/MIME\nmessage validation, an out of bounds read can happen.\n\nImpact summary: This out of bounds read will not directly exfiltrate\nthe data read to the attacker so the most likely result is a crash and\na Denial of Service.\n\nAn internal helper function called from X509_VERIFY_PARAM_[set|add]_email()\nused a wrong length when validating the local part of an email address.\nThis could cause the 64 octet limit on the local part of an email address\nto be not enforced, or cause an out of bound read and potentially a crash.\n\nThe bug is reachable via S-MIME validation with a crafted From: address\nsupplied in an email message that can potentially cause a crash.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-09","epss":0.00178,"percentile":0.06802}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-09","epss":0.00178,"percentile":0.06802}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-09","epss":0.00178,"percentile":0.06802}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-09","epss":0.00178,"percentile":0.06802}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"26333e82a7f1194a","cpes":["cpe:2.3:a:redhat:glibc:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-09","epss":0.00124,"percentile":0.0191}],"risk":0.0744,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-09","epss":0.00124,"percentile":0.0191}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"a69a465221b314ff","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-09","epss":0.00124,"percentile":0.0191}],"risk":0.0744,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-09","epss":0.00124,"percentile":0.0191}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"75ec3abb14d3aef9","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-09","epss":0.00124,"percentile":0.0191}],"risk":0.0744,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-09","epss":0.00124,"percentile":0.0191}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86469","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86469","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-10-09","epss":0.00141,"percentile":0.02966}],"risk":0.07261500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."},"relatedVulnerabilities":[{"id":"CVE-2026-86469","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-10-09","epss":0.00141,"percentile":0.02966}],"urls":["https://access.redhat.com/security/cve/CVE-2026-86469","https://bugzilla.redhat.com/show_bug.cgi?id=2473839","https://gitlab.gnome.org/GNOME/glib/-/blob/main/gio/glocalfileoutputstream.c","https://gitlab.gnome.org/GNOME/glib/-/work_items/4044"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"bc84359e8ec6ca3d","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-09","epss":0.00119,"percentile":0.01652}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41257","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-41257","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41257","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41257","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41257","date":"2026-10-09","epss":0.00137,"percentile":0.02725}],"risk":0.07192499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41257","description":"A flaw was found in jq, a command line JSON processor. The memory allocation size is calculated using a signed integer that can overflow when processing deeply nested generator forks. This integer overflow allows an attacker who can supply a sufficiently nested input to influence the memory allocation size, causing an out-of-bounds write and an application crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-41257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41257","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41257","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41257","date":"2026-10-09","epss":0.00137,"percentile":0.02725}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41257","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets."}]},{"artifact":{"id":"26333e82a7f1194a","cpes":["cpe:2.3:a:redhat:glibc:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-09","epss":0.00144,"percentile":0.03203}],"risk":0.07128000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18374","description":"A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-09","epss":0.00144,"percentile":0.03203}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"a69a465221b314ff","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-09","epss":0.00144,"percentile":0.03203}],"risk":0.07128000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18374","description":"A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-09","epss":0.00144,"percentile":0.03203}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"75ec3abb14d3aef9","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-142.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-142.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-142.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-142.el10_2.src.rpm","type":"rpm","version":"2.39-142.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-142.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-142.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-09","epss":0.00144,"percentile":0.03203}],"risk":0.07128000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18374","description":"A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-09","epss":0.00144,"percentile":0.03203}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39314","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-39314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39314","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39314","date":"2026-10-09","epss":0.00158,"percentile":0.04365}],"risk":0.07110000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-39314","description":"A flaw was found in CUPS, an open-source printing system. An unprivileged local user can exploit an integer underflow vulnerability by providing a negative job-password-supported Internet Printing Protocol (IPP) attribute. This manipulation causes the cupsd root process to crash, which can be repeatedly triggered to achieve a sustained Denial of Service (DoS) on the system."},"relatedVulnerabilities":[{"id":"CVE-2026-39314","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39314","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39314","date":"2026-10-09","epss":0.00158,"percentile":0.04365}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39314","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39314","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-39314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39314","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39314","date":"2026-10-09","epss":0.00158,"percentile":0.04365}],"risk":0.07110000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-39314","description":"A flaw was found in CUPS, an open-source printing system. An unprivileged local user can exploit an integer underflow vulnerability by providing a negative job-password-supported Internet Printing Protocol (IPP) attribute. This manipulation causes the cupsd root process to crash, which can be repeatedly triggered to achieve a sustained Denial of Service (DoS) on the system."},"relatedVulnerabilities":[{"id":"CVE-2026-39314","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39314","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39314","date":"2026-10-09","epss":0.00158,"percentile":0.04365}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39314","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-43895","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-43895","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43895","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-43895","cwe":"CWE-158","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-43895","date":"2026-10-09","epss":0.00151,"percentile":0.03776}],"risk":0.07097,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-43895","description":"A flaw was found in jq, a command line JSON processor. Embedded NUL bytes in import paths are truncated during module and data-file lookup, creating a mismatch between the intended import string and the actual file path opened. This issue allows an attacker who can supply a crafted script to access unintended files."},"relatedVulnerabilities":[{"id":"CVE-2026-43895","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43895","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-43895","cwe":"CWE-158","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-43895","date":"2026-10-09","epss":0.00151,"percentile":0.03776}],"urls":["https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43895","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens."}]},{"artifact":{"id":"06bca5f3c352e683","cpes":["cpe:2.3:a:pam-libs:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam-libs:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam_libs:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam_libs:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*"],"name":"pam-libs","purl":"pkg:rpm/redhat/pam-libs@1.6.1-9.el10_2.1?arch=x86_64&distro=rhel-10.2&upstream=pam-1.6.1-9.el10_2.1.src.rpm","type":"rpm","version":"1.6.1-9.el10_2.1","language":"","licenses":["BSD-3-Clause AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pam","version":"1.6.1-9.el10_2.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12610","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pam","version":"1.6.1-9.el10_2.1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-12610","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-10-09","epss":0.00121,"percentile":0.01765}],"risk":0.06897,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."},"relatedVulnerabilities":[{"id":"CVE-2026-12610","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-10-09","epss":0.00121,"percentile":0.01765}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12610","https://bugzilla.redhat.com/show_bug.cgi?id=2490288","https://github.com/SSSD/sssd/issues/8796"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."}]},{"artifact":{"id":"c91f3dfe522fe9b8","cpes":["cpe:2.3:a:redhat:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:jq:jq:1.7.1-11.el10_2.2:*:*:*:*:*:*:*"],"name":"jq","purl":"pkg:rpm/redhat/jq@1.7.1-11.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=jq-1.7.1-11.el10_2.2.src.rpm","type":"rpm","version":"1.7.1-11.el10_2.2","language":"","licenses":["MIT and ASL 2.0 and CC-BY and GPLv3"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-9403","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"jq","version":"0:1.7.1-11.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-9403","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9403","cwe":"CWE-617","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-9403","date":"2026-10-09","epss":0.00216,"percentile":0.11015}],"risk":0.06803999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9403","description":"A vulnerability has been identified in the jq JSON processor where malformed JSON input containing invalid Unicode escape sequences can trigger an assertion failure in the test suite’s parsing consistency checks. This flaw arises from inconsistencies between expected and reparsed JSON values during serialization and deserialization, potentially allowing an attacker to exploit the issue by supplying specially crafted JSON data to cause abnormal termination or denial of service during test execution, highlighting weaknesses in jq’s parsing reliability."},"relatedVulnerabilities":[{"id":"CVE-2025-9403","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9403","cwe":"CWE-617","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-9403","date":"2026-10-09","epss":0.00216,"percentile":0.11015}],"urls":["https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharing","https://github.com/jqlang/jq/issues/3393","https://vuldb.com/?ctiid.321239","https://vuldb.com/?id.321239","https://vuldb.com/?submit.633170"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9403","description":"A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well."}]},{"artifact":{"id":"9325a315e969bb38","cpes":["cpe:2.3:a:libevent:libevent:2.1.13-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.13-1.el10_2:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.13-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libevent-2.1.13-1.el10_2.src.rpm","type":"rpm","version":"2.1.13-1.el10_2","language":"","licenses":["BSD-3-Clause AND ISC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63380","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libevent","version":"0:2.1.13-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-63380","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63380","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63380","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63380","date":"2026-10-09","epss":0.0014,"percentile":0.02927}],"risk":0.0679,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63380","description":"A flaw was found in Libevent, an event notification library. This vulnerability allows a local attacker to trigger a null pointer dereference during specific error handling within the `evws_new_session` function. By inducing an allocation or locking failure, an attacker can cause the application to crash, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-63380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63380","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63380","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63380","date":"2026-10-09","epss":0.0014,"percentile":0.02927}],"urls":["https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63380","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-64118","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-64118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64118","cwe":"CWE-362","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-64118","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64118","date":"2026-10-09","epss":0.00134,"percentile":0.0254}],"risk":0.06499,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-64118","description":"A flaw was found in node-tar, a Tar utility for Node.js. This vulnerability allows a local attacker to potentially disclose sensitive information. When the .t (or .list) function is used with { sync: true } to read tar entry contents, and the tar file is concurrently modified on disk to a smaller size, the function may return uninitialized memory contents. This could lead to the exposure of arbitrary data."},"relatedVulnerabilities":[{"id":"CVE-2025-64118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64118","cwe":"CWE-362","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-64118","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64118","date":"2026-10-09","epss":0.00134,"percentile":0.0254}],"urls":["https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d","https://github.com/isaacs/node-tar/issues/445","https://github.com/isaacs/node-tar/pull/446","https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64118","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2."}]},{"artifact":{"id":"55696820e53646db","cpes":["cpe:2.3:a:org.jline.reader:jline-reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.reader:jline_reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:jline-reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:jline_reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:jline-reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:jline_reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.reader:reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:reader:jline-reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:reader:jline_reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:reader:reader:3.21.0:*:*:*:*:*:*:*","cpe:2.3:a:jline:reader:3.21.0:*:*:*:*:*:*:*"],"name":"jline-reader","purl":"pkg:maven/org.jline/jline-reader@3.21.0","type":"java-archive","version":"3.21.0","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"org.jline","virtualPath":"/var/lib/neo4j/lib/jline-reader-3.21.0.jar","manifestName":"","pomArtifactID":"jline-reader","archiveDigests":[{"value":"9cd5c76dd2a47e9e0e7ab39821c0f62fa46e8581","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/jline-reader-3.21.0.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/jline-reader-3.21.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5q95-hrpc-m3w3","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-reader","version":"3.21.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5q95-hrpc-m3w3","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77420","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77420","date":"2026-10-09","epss":0.00123,"percentile":0.01851}],"risk":0.06457500000000001,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5q95-hrpc-m3w3","description":"JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable"},"relatedVulnerabilities":[{"id":"CVE-2026-77420","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77420","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77420","date":"2026-10-09","epss":0.00123,"percentile":0.01851}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77420","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5916","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5916","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5916","date":"2026-10-09","epss":0.00185,"percentile":0.07416}],"risk":0.06382499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5916","description":"A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0."},"relatedVulnerabilities":[{"id":"CVE-2025-5916","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5916","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5916","date":"2026-10-09","epss":0.00185,"percentile":0.07416}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5916","https://bugzilla.redhat.com/show_bug.cgi?id=2370872","https://github.com/libarchive/libarchive/pull/2568","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5916","description":"A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5917","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5917","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5917","date":"2026-10-09","epss":0.00214,"percentile":0.1072}],"risk":0.06205999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5917","description":"A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0."},"relatedVulnerabilities":[{"id":"CVE-2025-5917","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5917","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5917","date":"2026-10-09","epss":0.00214,"percentile":0.1072}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5917","https://bugzilla.redhat.com/show_bug.cgi?id=2370874","https://github.com/libarchive/libarchive/pull/2588","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5917","description":"A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0."}]},{"artifact":{"id":"95155a12be9544f8","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.4.5-4.el10_1?arch=x86_64&distro=rhel-10.2&upstream=gnupg2-2.4.5-4.el10_1.src.rpm","type":"rpm","version":"2.4.5-4.el10_1","language":"","licenses":["CC0-1.0 AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later AND (BSD-3-Clause OR LGPL-3.0-or-later OR GPL-2.0-or-later) AND CC-BY-4.0 AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-68972","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnupg2","version":"0:2.4.5-4.el10_1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-68972","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68972","cwe":"CWE-347","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-68972","date":"2026-10-09","epss":0.00113,"percentile":0.01357}],"risk":0.061585,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-68972","description":"A flaw was found in GnuPG. An adversary can exploit this vulnerability by crafting a signed message that includes a form feed character (\\f) at the end of a plaintext line. This allows the adversary to append additional, unsigned text to the message while the signature verification still reports success. This issue leads to an integrity bypass, potentially enabling the spoofing of signed communications."},"relatedVulnerabilities":[{"id":"CVE-2025-68972","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68972","cwe":"CWE-347","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-68972","date":"2026-10-09","epss":0.00113,"percentile":0.01357}],"urls":["https://gpg.fail/formfeed","https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i","https://news.ycombinator.com/item?id=46404339"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line."}]},{"artifact":{"id":"a3fc973d5d02135f","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mcr4-qmvw-px4g","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mcr4-qmvw-px4g","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106451","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106451","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106451","date":"2026-10-09","epss":0.00083,"percentile":0.00225}],"risk":0.061419999999999995,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g","https://nvd.nist.gov/vuln/detail/CVE-2026-106451","https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mcr4-qmvw-px4g","description":"yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user"},"relatedVulnerabilities":[{"id":"CVE-2026-106451","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106451","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106451","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106451","date":"2026-10-09","epss":0.00083,"percentile":0.00225}],"urls":["https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106451","description":"yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27171","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27171","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-09","epss":0.00191,"percentile":0.08082}],"risk":0.06016499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27171","description":"A flaw was found in zlib. An attacker providing specially crafted input to the `crc32_combine64` or `crc32_combine_gen64` functions could trigger an infinite loop within the `x2nmodp` function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-27171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-09","epss":0.00191,"percentile":0.08082}],"urls":["https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/","https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf","https://github.com/madler/zlib/issues/904","https://github.com/madler/zlib/releases/tag/v1.3.2","https://ostif.org/zlib-audit-complete/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-67693","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-67693","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-10-09","epss":0.0011,"percentile":0.01222}],"risk":0.05995000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-67693","description":"A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage (KU) and Extended Key Usage (EKU) extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could exploit this flaw by presenting a specially crafted certificate to bypass validation controls, potentially resulting in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-67693","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-10-09","epss":0.0011,"percentile":0.01222}],"urls":["http://gnutls.com","https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693","description":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)"}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105326","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-105326","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105326","cwe":"CWE-88","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-105326","date":"2026-10-09","epss":0.00217,"percentile":0.1111}],"risk":0.059675000000000006,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-105326","description":"An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."},"relatedVulnerabilities":[{"id":"CVE-2026-105326","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105326","cwe":"CWE-88","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-105326","date":"2026-10-09","epss":0.00217,"percentile":0.1111}],"urls":["https://access.redhat.com/errata/RHSA-2026:77638","https://access.redhat.com/security/cve/CVE-2026-105326","https://bugzilla.redhat.com/show_bug.cgi?id=2545835","https://github.com/OpenPrinting/cups/commit/1244ed9","https://github.com/OpenPrinting/cups/commit/611d1bd","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105326","description":"An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105326","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-105326","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105326","cwe":"CWE-88","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-105326","date":"2026-10-09","epss":0.00217,"percentile":0.1111}],"risk":0.059675000000000006,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-105326","description":"An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."},"relatedVulnerabilities":[{"id":"CVE-2026-105326","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105326","cwe":"CWE-88","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-105326","date":"2026-10-09","epss":0.00217,"percentile":0.1111}],"urls":["https://access.redhat.com/errata/RHSA-2026:77638","https://access.redhat.com/security/cve/CVE-2026-105326","https://bugzilla.redhat.com/show_bug.cgi?id=2545835","https://github.com/OpenPrinting/cups/commit/1244ed9","https://github.com/OpenPrinting/cups/commit/611d1bd","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105326","description":"An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."}]},{"artifact":{"id":"62d317a34f380a43","cpes":["cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:rpm/redhat/alsa-lib@1.2.15.3-2.el10?arch=x86_64&distro=rhel-10.2&upstream=alsa-lib-1.2.15.3-2.el10.src.rpm","type":"rpm","version":"1.2.15.3-2.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-96675","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"alsa-lib","version":"0:1.2.15.3-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-96675","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-10-09","epss":0.00111,"percentile":0.01236}],"risk":0.05827500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-96675","description":"A flaw was found in alsa-lib. This denial of service vulnerability exists in the multi PCM plugin due to a failure to validate sparse binding indices before array access. A local attacker can supply a malicious ALSA configuration file with sparse bindings. This can trigger an out-of-bounds array read and assertion failure, causing the application to terminate unexpectedly."},"relatedVulnerabilities":[{"id":"CVE-2026-96675","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-10-09","epss":0.00111,"percentile":0.01236}],"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96675","description":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107655","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107655","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-10-09","epss":0.00128,"percentile":0.02133}],"risk":0.0576,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107655","description":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services."},"relatedVulnerabilities":[{"id":"CVE-2026-107655","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-10-09","epss":0.00128,"percentile":0.02133}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107655","https://bugzilla.redhat.com/show_bug.cgi?id=2548399","https://github.com/OpenPrinting/cups/commit/12237ad","https://github.com/OpenPrinting/cups/commit/25d6830","https://github.com/OpenPrinting/cups/security/advisories/GHSA-58wv-9ffm-5w78"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107655","description":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107655","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107655","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-10-09","epss":0.00128,"percentile":0.02133}],"risk":0.0576,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107655","description":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services."},"relatedVulnerabilities":[{"id":"CVE-2026-107655","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-10-09","epss":0.00128,"percentile":0.02133}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107655","https://bugzilla.redhat.com/show_bug.cgi?id=2548399","https://github.com/OpenPrinting/cups/commit/12237ad","https://github.com/OpenPrinting/cups/commit/25d6830","https://github.com/OpenPrinting/cups/security/advisories/GHSA-58wv-9ffm-5w78"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107655","description":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-09","epss":0.00118,"percentile":0.01588}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"9bd6bb772c2f0fd0","cpes":["cpe:2.3:a:libgcrypt:libgcrypt:1.11.0-7.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcrypt:1.11.0-7.el10_2:*:*:*:*:*:*:*"],"name":"libgcrypt","purl":"pkg:rpm/redhat/libgcrypt@1.11.0-7.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libgcrypt-1.11.0-7.el10_2.src.rpm","type":"rpm","version":"1.11.0-7.el10_2","language":"","licenses":["BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libgcrypt","version":"0:1.11.0-7.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-41990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.3,"impactScore":2.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41990","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41990","date":"2026-10-09","epss":0.0018,"percentile":0.06971}],"risk":0.05669999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41990","description":"A flaw was found in Libgcrypt. During Dilithium signing operations, the library fails to perform a bounds check when writing to a static array. While the data involved is not directly controlled by an attacker, this vulnerability could lead to memory corruption, potentially resulting in a denial of service (DoS) or affecting data integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-41990","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41990","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41990","date":"2026-10-09","epss":0.0018,"percentile":0.06971}],"urls":["https://dev.gnupg.org/T8208","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html","https://www.openwall.com/lists/oss-security/2026/04/21/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41990","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-14017","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14017","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-09","epss":0.00114,"percentile":0.01389}],"risk":0.05585999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14017","description":"A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed."},"relatedVulnerabilities":[{"id":"CVE-2025-14017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-09","epss":0.00114,"percentile":0.01389}],"urls":["https://curl.se/docs/CVE-2025-14017.html","https://curl.se/docs/CVE-2025-14017.json","http://www.openwall.com/lists/oss-security/2026/01/07/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","description":"When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14017","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14017","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-09","epss":0.00114,"percentile":0.01389}],"risk":0.05585999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14017","description":"A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed."},"relatedVulnerabilities":[{"id":"CVE-2025-14017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-09","epss":0.00114,"percentile":0.01389}],"urls":["https://curl.se/docs/CVE-2025-14017.html","https://curl.se/docs/CVE-2025-14017.json","http://www.openwall.com/lists/oss-security/2026/01/07/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","description":"When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."}]},{"artifact":{"id":"95155a12be9544f8","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.4.5-4.el10_1?arch=x86_64&distro=rhel-10.2&upstream=gnupg2-2.4.5-4.el10_1.src.rpm","type":"rpm","version":"2.4.5-4.el10_1","language":"","licenses":["CC0-1.0 AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later AND (BSD-3-Clause OR LGPL-3.0-or-later OR GPL-2.0-or-later) AND CC-BY-4.0 AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-30258","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnupg2","version":"0:2.4.5-4.el10_1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-30258","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-30258","cwe":"CWE-754","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-30258","date":"2026-10-09","epss":0.00191,"percentile":0.07991}],"risk":0.05443500000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-30258","description":"A flaw was found in GnuPG. In affected versions, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, leading to a verification denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-30258","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-30258","cwe":"CWE-754","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-30258","date":"2026-10-09","epss":0.00191,"percentile":0.07991}],"urls":["https://dev.gnupg.org/T7527","https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158","https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30258","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\""}]},{"artifact":{"id":"62d317a34f380a43","cpes":["cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-2.el10:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-2.el10:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:rpm/redhat/alsa-lib@1.2.15.3-2.el10?arch=x86_64&distro=rhel-10.2&upstream=alsa-lib-1.2.15.3-2.el10.src.rpm","type":"rpm","version":"1.2.15.3-2.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-96674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"alsa-lib","version":"0:1.2.15.3-2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-96674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-10-09","epss":0.00115,"percentile":0.01454}],"risk":0.05405000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-96674","description":"A flaw was found in alsa-lib. This vulnerability involves an integer overflow in the src/topology/ctl.c component, where combined topology element sizes are computed using 32-bit arithmetic. This allows an attacker to supply specially crafted topology files that can cause size calculations to wrap around, bypassing bounds checks. Successful exploitation could lead to reading beyond the intended buffer, potentially resulting in sensitive data leakage or application crashes, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-96674","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-10-09","epss":0.00115,"percentile":0.01454}],"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96674","description":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."}]},{"artifact":{"id":"6824cdbfa3473117","cpes":["cpe:2.3:a:java-21-openjdk-headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk-headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk_headless:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21-openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21_openjdk:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java-21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java_21:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java-21-openjdk-headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*","cpe:2.3:a:java:java_21_openjdk_headless:1\\:21.0.12.1.1-1.2.el10:*:*:*:*:*:*:*"],"name":"java-21-openjdk-headless","purl":"pkg:rpm/redhat/java-21-openjdk-headless@21.0.12.1.1-1.2.el10?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=java-21-openjdk-21.0.12.1.1-1.2.el10.src.rpm","type":"rpm","version":"1:21.0.12.1.1-1.2.el10","language":"","licenses":["ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49919","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"java-21-openjdk","version":"21.0.12.1.1-1.2.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-49919","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49919","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-49919","date":"2026-10-09","epss":0.00099,"percentile":0.00781}],"risk":0.05346,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-49919","description":"A flaw was found in FreeType. An attacker could cause an application crash leading to a Denial of Service (DoS) by tricking a user or application into rendering a specially crafted color font. This issue occurs due to an integer overflow during bitmap dimension calculations when blending color font layers, resulting in an undersized memory allocation. FreeType subsequently performs an out-of-bounds write to heap memory, corrupting process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-49919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49919","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-49919","date":"2026-10-09","epss":0.00099,"percentile":0.00781}],"urls":["https://source.android.com/docs/security/bulletin/2026/2026-09-01"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49919","description":"In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}]},{"artifact":{"id":"10083edcbc977dbf","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2625","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-2625","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2625","cwe":"CWE-347","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2625","date":"2026-10-09","epss":0.00114,"percentile":0.01399}],"risk":0.0513,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-2625","description":"A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification."},"relatedVulnerabilities":[{"id":"CVE-2026-2625","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2625","cwe":"CWE-347","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2625","date":"2026-10-09","epss":0.00114,"percentile":0.01399}],"urls":["https://access.redhat.com/errata/RHSA-2026:12682","https://access.redhat.com/security/cve/CVE-2026-2625","https://bugzilla.redhat.com/show_bug.cgi?id=2440357"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2625","description":"A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification."}]},{"artifact":{"id":"7781ba39273ff956","cpes":["cpe:2.3:a:neo4j-graph-database-project:neo4j:5.26.31:*:*:*:*:*:*:*","cpe:2.3:a:neo4j_graph_database_project:neo4j:5.26.31:*:*:*:*:*:*:*","cpe:2.3:a:org.neo4j.community:neo4j:5.26.31:*:*:*:*:*:*:*","cpe:2.3:a:community:neo4j:5.26.31:*:*:*:*:*:*:*","cpe:2.3:a:org.neo4j:neo4j:5.26.31:*:*:*:*:*:*:*","cpe:2.3:a:neo4j:neo4j:5.26.31:*:*:*:*:*:*:*"],"name":"neo4j","purl":"pkg:maven/org.neo4j/neo4j@5.26.31","type":"java-archive","version":"5.26.31","language":"java","licenses":["Apache-2.0","BSD-2-Clause","BSD-3-Clause","CDDL-1.1","EPL-1.0","EPL-2.0","GPL-2.0","GPL-3.0","MIT","MIT-0","MPL-2.0","Unlicense"],"metadata":{"pomGroupID":"org.neo4j","virtualPath":"/var/lib/neo4j/lib/neo4j-5.26.31.jar","manifestName":"","pomArtifactID":"neo4j","archiveDigests":[{"value":"0b8a2421067559fe8d84c70953cb31c3365c44fa","algorithm":"sha1"}]},"locations":[{"path":"/var/lib/neo4j/lib/neo4j-5.26.31.jar","layerID":"sha256:13c819e79c1e5d3972f7ab57e63b07a33b031ed027bed6ac3101b17b3b79187a","accessPath":"/var/lib/neo4j/lib/neo4j-5.26.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2026.01"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xr72-g735-4vwp","versionConstraint":"<2026.01 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.neo4j:neo4j","version":"5.26.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xr72-g735-4vwp","fix":{"state":"fixed","versions":["2026.01"],"available":[{"date":"2026-02-07","kind":"first-observed","version":"2026.01"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P","metrics":{"baseScore":1.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1337","cwe":"CWE-117","type":"Secondary","source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}],"epss":[{"cve":"CVE-2026-1337","date":"2026-10-09","epss":0.00249,"percentile":0.14884}],"risk":0.05104500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-1337","https://github.com/JoakimBulow/CVE-2026-1337"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xr72-g735-4vwp","description":"Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log"},"relatedVulnerabilities":[{"id":"CVE-2026-1337","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1337","cwe":"CWE-117","type":"Secondary","source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}],"epss":[{"cve":"CVE-2026-1337","date":"2026-10-09","epss":0.00249,"percentile":0.14884}],"urls":["https://github.com/JoakimBulow/CVE-2026-1337"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1337","description":"Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.\n\nProof of concept exploit:  https://github.com/JoakimBulow/CVE-2026-1337"}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107888","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107888","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107888","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107888","date":"2026-10-09","epss":0.00096,"percentile":0.00674}],"risk":0.04848,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107888","description":"A flaw was found in CUPS. An attacker with access to the local print service can cause a Denial of Service (DoS) by submitting a held print job targeted at a temporary printer that is subsequently deleted. Because the print scheduler fails to verify that the printer destination still exists before checking the job status, it accesses invalid memory and crashes the cupsd daemon, interrupting all managed print queues."},"relatedVulnerabilities":[{"id":"CVE-2026-107888","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107888","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107888","date":"2026-10-09","epss":0.00096,"percentile":0.00674}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107888","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107888","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107888","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107888","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107888","date":"2026-10-09","epss":0.00096,"percentile":0.00674}],"risk":0.04848,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107888","description":"A flaw was found in CUPS. An attacker with access to the local print service can cause a Denial of Service (DoS) by submitting a held print job targeted at a temporary printer that is subsequently deleted. Because the print scheduler fails to verify that the printer destination still exists before checking the job status, it accesses invalid memory and crashes the cupsd daemon, interrupting all managed print queues."},"relatedVulnerabilities":[{"id":"CVE-2026-107888","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107888","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107888","date":"2026-10-09","epss":0.00096,"percentile":0.00674}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107888","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1485","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-1485","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1485","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1485","date":"2026-10-09","epss":0.00158,"percentile":0.04411}],"risk":0.04582,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1485","description":"A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-1485","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1485","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1485","date":"2026-10-09","epss":0.00158,"percentile":0.04411}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1485","https://bugzilla.redhat.com/show_bug.cgi?id=2433325","https://gitlab.gnome.org/GNOME/glib/-/issues/3871"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1485","description":"A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability."}]},{"artifact":{"id":"95155a12be9544f8","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.4.5-4.el10_1?arch=x86_64&distro=rhel-10.2&upstream=gnupg2-2.4.5-4.el10_1.src.rpm","type":"rpm","version":"2.4.5-4.el10_1","language":"","licenses":["CC0-1.0 AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later AND (BSD-3-Clause OR LGPL-3.0-or-later OR GPL-2.0-or-later) AND CC-BY-4.0 AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57062","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnupg2","version":"0:2.4.5-4.el10_1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-57062","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57062","cwe":"CWE-1284","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-57062","date":"2026-10-09","epss":0.00149,"percentile":0.03612}],"risk":0.043955,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-57062","description":"A flaw in GnuPG's gpgsm component improperly handles the Cryptographic Message Syntax (CMS) format for AES-GCM. By accepting an authentication tag length of 4 bytes instead of the required 12 bytes, this vulnerability allows for a low-impact data integrity issue where the cryptographic validity of messages could be compromised."},"relatedVulnerabilities":[{"id":"CVE-2026-57062","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57062","cwe":"CWE-1284","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-57062","date":"2026-10-09","epss":0.00149,"percentile":0.03612}],"urls":["https://blog.calif.io/p/how-to-format-a-ciphertext","https://www.gnupg.org/download/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57062","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182."}]},{"artifact":{"id":"95155a12be9544f8","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.4.5-4.el10_1:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.4.5-4.el10_1?arch=x86_64&distro=rhel-10.2&upstream=gnupg2-2.4.5-4.el10_1.src.rpm","type":"rpm","version":"2.4.5-4.el10_1","language":"","licenses":["CC0-1.0 AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later AND (BSD-3-Clause OR LGPL-3.0-or-later OR GPL-2.0-or-later) AND CC-BY-4.0 AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnupg2","version":"0:2.4.5-4.el10_1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-10-09","epss":0.00123,"percentile":0.01875}],"risk":0.040589999999999994,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-105712","description":"A flaw was found in the gpgtar utility in GnuPG. When extracting an archive into a directory containing pre-existing symbolic links (symlinks), the tool can follow those links instead of staying within the target directory. An attacker can provide a crafted archive that, when extracted by an unsuspecting user, creates or overwrites files outside the intended destination directory. Any unauthorized file writes are limited to the filesystem permissions of the user performing the extraction."},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-10-09","epss":0.00123,"percentile":0.01875}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"f436c8199aca5316","cpes":["cpe:2.3:a:redhat:popt:1.19-8.el10:*:*:*:*:*:*:*","cpe:2.3:a:popt:popt:1.19-8.el10:*:*:*:*:*:*:*"],"name":"popt","purl":"pkg:rpm/redhat/popt@1.19-8.el10?arch=x86_64&distro=rhel-10.2&upstream=popt-1.19-8.el10.src.rpm","type":"rpm","version":"1.19-8.el10","language":"","licenses":["MIT AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18743","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"popt","version":"0:1.19-8.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18743","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18743","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18743","date":"2026-10-09","epss":0.00141,"percentile":0.02983}],"risk":0.038775000000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18743","description":"A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service)."},"relatedVulnerabilities":[{"id":"CVE-2026-18743","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18743","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18743","date":"2026-10-09","epss":0.00141,"percentile":0.02983}],"urls":["https://access.redhat.com/errata/RHSA-2026:56984","https://access.redhat.com/security/cve/CVE-2026-18743","https://bugzilla.redhat.com/show_bug.cgi?id=2510809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18743","description":"A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service)."}]},{"artifact":{"id":"f436c8199aca5316","cpes":["cpe:2.3:a:redhat:popt:1.19-8.el10:*:*:*:*:*:*:*","cpe:2.3:a:popt:popt:1.19-8.el10:*:*:*:*:*:*:*"],"name":"popt","purl":"pkg:rpm/redhat/popt@1.19-8.el10?arch=x86_64&distro=rhel-10.2&upstream=popt-1.19-8.el10.src.rpm","type":"rpm","version":"1.19-8.el10","language":"","licenses":["MIT AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18739","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"popt","version":"0:1.19-8.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18739","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18739","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18739","date":"2026-10-09","epss":0.0014,"percentile":0.02938}],"risk":0.038500000000000006,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18739","description":"A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data."},"relatedVulnerabilities":[{"id":"CVE-2026-18739","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18739","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18739","date":"2026-10-09","epss":0.0014,"percentile":0.02938}],"urls":["https://access.redhat.com/errata/RHSA-2026:56984","https://access.redhat.com/security/cve/CVE-2026-18739","https://bugzilla.redhat.com/show_bug.cgi?id=2510737"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18739","description":"A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data."}]},{"artifact":{"id":"f436c8199aca5316","cpes":["cpe:2.3:a:redhat:popt:1.19-8.el10:*:*:*:*:*:*:*","cpe:2.3:a:popt:popt:1.19-8.el10:*:*:*:*:*:*:*"],"name":"popt","purl":"pkg:rpm/redhat/popt@1.19-8.el10?arch=x86_64&distro=rhel-10.2&upstream=popt-1.19-8.el10.src.rpm","type":"rpm","version":"1.19-8.el10","language":"","licenses":["MIT AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18839","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"popt","version":"0:1.19-8.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18839","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18839","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18839","date":"2026-10-09","epss":0.00126,"percentile":0.02051}],"risk":0.032760000000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18839","description":"An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-18839","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18839","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18839","date":"2026-10-09","epss":0.00126,"percentile":0.02051}],"urls":["https://access.redhat.com/errata/RHSA-2026:77932","https://access.redhat.com/security/cve/CVE-2026-18839","https://bugzilla.redhat.com/show_bug.cgi?id=2511010"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18839","description":"An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107885","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107885","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107885","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107885","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"risk":0.030555,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107885","description":"A flaw was found in cups. An attacker with network access to the Internet Printing Protocol (IPP) service can cause a Denial of Service (DoS) by initiating a document submission request and keeping the connection open without completing it. The print scheduler globally pauses timeout processing for all jobs while any document transfer is active, preventing abandoned jobs from expiring. An attacker can repeatedly submit incomplete jobs until the system's job limit is reached, causing legitimate print requests to be rejected."},"relatedVulnerabilities":[{"id":"CVE-2026-107885","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107885","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107885","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-hhw5-qqmc-p6rg"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107885","description":"OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107890","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107890","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107890","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107890","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"risk":0.030555,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107890","description":"A flaw was found in CUPS. An attacker who can submit print jobs can exploit this issue by sending a crafted request containing repeated Internet Printing Protocol (IPP) group tags. This triggers a NULL pointer dereference during job processing, causing the print scheduler daemon (cupsd) to crash and resulting in a Denial of Service (DoS) across all print queues."},"relatedVulnerabilities":[{"id":"CVE-2026-107890","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107890","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107890","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107890","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107885","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107885","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107885","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107885","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"risk":0.030555,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107885","description":"A flaw was found in cups. An attacker with network access to the Internet Printing Protocol (IPP) service can cause a Denial of Service (DoS) by initiating a document submission request and keeping the connection open without completing it. The print scheduler globally pauses timeout processing for all jobs while any document transfer is active, preventing abandoned jobs from expiring. An attacker can repeatedly submit incomplete jobs until the system's job limit is reached, causing legitimate print requests to be rejected."},"relatedVulnerabilities":[{"id":"CVE-2026-107885","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107885","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107885","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-hhw5-qqmc-p6rg"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107885","description":"OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107890","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107890","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107890","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107890","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"risk":0.030555,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107890","description":"A flaw was found in CUPS. An attacker who can submit print jobs can exploit this issue by sending a crafted request containing repeated Internet Printing Protocol (IPP) group tags. This triggers a NULL pointer dereference during job processing, causing the print scheduler daemon (cupsd) to crash and resulting in a Denial of Service (DoS) across all print queues."},"relatedVulnerabilities":[{"id":"CVE-2026-107890","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107890","cwe":"CWE-476","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107890","date":"2026-10-09","epss":0.00097,"percentile":0.00682}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107890","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration."}]},{"artifact":{"id":"43da130174f1f88c","cpes":["cpe:2.3:a:cups-filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_filesystem:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_filesystem:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-filesystem","purl":"pkg:rpm/redhat/cups-filesystem@2.4.10-18.el10_2?arch=noarch&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107886","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107886","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-10-09","epss":0.00103,"percentile":0.00944}],"risk":0.027295000000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107886","description":"A flaw was found in CUPS. An authenticated user authorized to manage printer classes can cause a Denial of Service (DoS) by triggering a double-free memory error during printer class management. By submitting a class modification request with invalid parameters followed by a class deletion request, the user can crash the print scheduler service."},"relatedVulnerabilities":[{"id":"CVE-2026-107886","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-10-09","epss":0.00103,"percentile":0.00944}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886","description":"OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges."}]},{"artifact":{"id":"fc1cee1f2a41a1d7","cpes":["cpe:2.3:a:cups-libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:1\\:2.4.10-18.el10_2:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:rpm/redhat/cups-libs@2.4.10-18.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=cups-2.4.10-18.el10_2.src.rpm","type":"rpm","version":"1:2.4.10-18.el10_2","language":"","licenses":["Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND Zlib AND BSD-2-Clause"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups","version":"2.4.10-18.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107886","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"cups","version":"2.4.10-18.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107886","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-10-09","epss":0.00103,"percentile":0.00944}],"risk":0.027295000000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107886","description":"A flaw was found in CUPS. An authenticated user authorized to manage printer classes can cause a Denial of Service (DoS) by triggering a double-free memory error during printer class management. By submitting a class modification request with invalid parameters followed by a class deletion request, the user can crash the print scheduler service."},"relatedVulnerabilities":[{"id":"CVE-2026-107886","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-10-09","epss":0.00103,"percentile":0.00944}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886","description":"OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:3992922bae271e7d9ff2b0c4768298878042e52cf6d8810235502de31dafa6ee","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-10-10T16:31:15.077Z","grype_db_version":"2026-10-10T06:30:01.000Z"}