{"grype_matches":[{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11187","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-11187","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11187","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2024-11187","date":"2026-10-19","epss":0.15842,"percentile":0.96854}],"risk":11.8815,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11187","description":"A flaw was found in the bind package where a crafted DNS zone may generate numerous records in the 'Additional' section of the response. This flaw allows an attacker to send a large amount of such queries, which may lead either the authoritative server or an independent resolver to run into an uncontrolled CPU resource scenario, ultimately resulting in the server not being able to attend new requests and causing a denial of service as a consequence."},"relatedVulnerabilities":[{"id":"CVE-2024-11187","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11187","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2024-11187","date":"2026-10-19","epss":0.15842,"percentile":0.96854}],"urls":["https://kb.isc.org/docs/cve-2024-11187","https://lists.debian.org/debian-lts-announce/2025/02/msg00011.html","https://security.netapp.com/advisory/ntap-20250207-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11187","description":"It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11187","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-11187","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11187","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2024-11187","date":"2026-10-19","epss":0.15842,"percentile":0.96854}],"risk":11.8815,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11187","description":"A flaw was found in the bind package where a crafted DNS zone may generate numerous records in the 'Additional' section of the response. This flaw allows an attacker to send a large amount of such queries, which may lead either the authoritative server or an independent resolver to run into an uncontrolled CPU resource scenario, ultimately resulting in the server not being able to attend new requests and causing a denial of service as a consequence."},"relatedVulnerabilities":[{"id":"CVE-2024-11187","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11187","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2024-11187","date":"2026-10-19","epss":0.15842,"percentile":0.96854}],"urls":["https://kb.isc.org/docs/cve-2024-11187","https://lists.debian.org/debian-lts-announce/2025/02/msg00011.html","https://security.netapp.com/advisory/ntap-20250207-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11187","description":"It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11187","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-11187","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11187","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2024-11187","date":"2026-10-19","epss":0.15842,"percentile":0.96854}],"risk":11.8815,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11187","description":"A flaw was found in the bind package where a crafted DNS zone may generate numerous records in the 'Additional' section of the response. This flaw allows an attacker to send a large amount of such queries, which may lead either the authoritative server or an independent resolver to run into an uncontrolled CPU resource scenario, ultimately resulting in the server not being able to attend new requests and causing a denial of service as a consequence."},"relatedVulnerabilities":[{"id":"CVE-2024-11187","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11187","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2024-11187","date":"2026-10-19","epss":0.15842,"percentile":0.96854}],"urls":["https://kb.isc.org/docs/cve-2024-11187","https://lists.debian.org/debian-lts-announce/2025/02/msg00011.html","https://security.netapp.com/advisory/ntap-20250207-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11187","description":"It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-19","epss":0.20202,"percentile":0.97442}],"risk":8.38383,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-19","epss":0.20202,"percentile":0.97442}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-19","epss":0.20202,"percentile":0.97442}],"risk":8.38383,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-19","epss":0.20202,"percentile":0.97442}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2005-2541","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2005-2541","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-19","epss":0.03992,"percentile":0.90406}],"risk":2.3951999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2005-2541","description":"A flaw was found in tar utility that can allow the root user to extract files with preserved setuid and setgid permissions without any warning. This behavior can lead to the creation of malicious setuid executables owned by root from a crafted tar file, posing significant security risks."},"relatedVulnerabilities":[{"id":"CVE-2005-2541","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-19","epss":0.03992,"percentile":0.90406}],"urls":["http://marc.info/?l=bugtraq&m=112327628230258&w=2","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-1737","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-1737","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1737","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1737","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"risk":1.5855000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-1737","description":"A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This vulnerability may lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-1737","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1737","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1737","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-1737","https://kb.isc.org/docs/rrset-limits-in-zones","https://security.netapp.com/advisory/ntap-20240731-0003/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1737","description":"Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-1975","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-1975","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1975","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1975","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"risk":1.5855000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-1975","description":"A flaw was found in the bind9 package, where if a DNS server hosts a zone containing a \"KEY\" resource record or a DNS resolver utilizes the DNSSEC validate feature to validate a \"KEY\" resource record, a malicious client could exhaust the CPU resourced from the resolver by sending a stream of SIG(0) signed requests. This issue can lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-1975","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1975","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1975","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-1975","https://security.netapp.com/advisory/ntap-20240731-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1975","description":"If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-1737","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-1737","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1737","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1737","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"risk":1.5855000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-1737","description":"A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This vulnerability may lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-1737","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1737","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1737","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-1737","https://kb.isc.org/docs/rrset-limits-in-zones","https://security.netapp.com/advisory/ntap-20240731-0003/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1737","description":"Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-1975","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-1975","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1975","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1975","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"risk":1.5855000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-1975","description":"A flaw was found in the bind9 package, where if a DNS server hosts a zone containing a \"KEY\" resource record or a DNS resolver utilizes the DNSSEC validate feature to validate a \"KEY\" resource record, a malicious client could exhaust the CPU resourced from the resolver by sending a stream of SIG(0) signed requests. This issue can lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-1975","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1975","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1975","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-1975","https://security.netapp.com/advisory/ntap-20240731-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1975","description":"If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-1737","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-1737","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1737","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1737","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"risk":1.5855000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-1737","description":"A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This vulnerability may lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-1737","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1737","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1737","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-1737","https://kb.isc.org/docs/rrset-limits-in-zones","https://security.netapp.com/advisory/ntap-20240731-0003/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1737","description":"Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-1975","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-1975","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1975","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1975","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"risk":1.5855000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-1975","description":"A flaw was found in the bind9 package, where if a DNS server hosts a zone containing a \"KEY\" resource record or a DNS resolver utilizes the DNSSEC validate feature to validate a \"KEY\" resource record, a malicious client could exhaust the CPU resourced from the resolver by sending a stream of SIG(0) signed requests. This issue can lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-1975","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1975","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1975","date":"2026-10-19","epss":0.02114,"percentile":0.81535}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-1975","https://security.netapp.com/advisory/ntap-20240731-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1975","description":"If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4076","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-4076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4076","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4076","date":"2026-10-19","epss":0.02111,"percentile":0.81514}],"risk":1.58325,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-4076","description":"A flaw was found in the bind9 package, where a client query triggers stale data and also requires local lookups may trigger a assertion failure. This issue results in a denial of service of the bind server."},"relatedVulnerabilities":[{"id":"CVE-2024-4076","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4076","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4076","date":"2026-10-19","epss":0.02111,"percentile":0.81514}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-4076","https://security.netapp.com/advisory/ntap-20240731-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4076","description":"Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4076","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-4076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4076","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4076","date":"2026-10-19","epss":0.02111,"percentile":0.81514}],"risk":1.58325,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-4076","description":"A flaw was found in the bind9 package, where a client query triggers stale data and also requires local lookups may trigger a assertion failure. This issue results in a denial of service of the bind server."},"relatedVulnerabilities":[{"id":"CVE-2024-4076","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4076","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4076","date":"2026-10-19","epss":0.02111,"percentile":0.81514}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-4076","https://security.netapp.com/advisory/ntap-20240731-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4076","description":"Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4076","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-4076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4076","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4076","date":"2026-10-19","epss":0.02111,"percentile":0.81514}],"risk":1.58325,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-4076","description":"A flaw was found in the bind9 package, where a client query triggers stale data and also requires local lookups may trigger a assertion failure. This issue results in a denial of service of the bind server."},"relatedVulnerabilities":[{"id":"CVE-2024-4076","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4076","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4076","date":"2026-10-19","epss":0.02111,"percentile":0.81514}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/23/1","http://www.openwall.com/lists/oss-security/2024/07/31/2","https://kb.isc.org/docs/cve-2024-4076","https://security.netapp.com/advisory/ntap-20240731-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4076","description":"Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-45490","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-45490","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-10-19","epss":0.01686,"percentile":0.76683}],"risk":1.05375,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-45490","description":"A flaw was found in libexpat's xmlparse.c component. This vulnerability allows an attacker to cause improper handling of XML data by providing a negative length value to the XML_ParseBuffer function."},"relatedVulnerabilities":[{"id":"CVE-2024-45490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-10-19","epss":0.01686,"percentile":0.76683}],"urls":["https://github.com/libexpat/libexpat/issues/887","https://github.com/libexpat/libexpat/pull/890","http://seclists.org/fulldisclosure/2024/Dec/10","http://seclists.org/fulldisclosure/2024/Dec/12","http://seclists.org/fulldisclosure/2024/Dec/6","http://seclists.org/fulldisclosure/2024/Dec/7","http://seclists.org/fulldisclosure/2024/Dec/8","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0004/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-4408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4408","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4408","date":"2026-10-19","epss":0.01338,"percentile":0.70833}],"risk":1.0034999999999998,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-4408","description":"A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2023-4408","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4408","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4408","date":"2026-10-19","epss":0.01338,"percentile":0.70833}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/13/1","https://kb.isc.org/docs/cve-2023-4408","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://security.netapp.com/advisory/ntap-20240426-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4408","description":"The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-4408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4408","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4408","date":"2026-10-19","epss":0.01338,"percentile":0.70833}],"risk":1.0034999999999998,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-4408","description":"A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2023-4408","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4408","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4408","date":"2026-10-19","epss":0.01338,"percentile":0.70833}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/13/1","https://kb.isc.org/docs/cve-2023-4408","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://security.netapp.com/advisory/ntap-20240426-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4408","description":"The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-4408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4408","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4408","date":"2026-10-19","epss":0.01338,"percentile":0.70833}],"risk":1.0034999999999998,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-4408","description":"A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2023-4408","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4408","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4408","date":"2026-10-19","epss":0.01338,"percentile":0.70833}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/13/1","https://kb.isc.org/docs/cve-2023-4408","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://security.netapp.com/advisory/ntap-20240426-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4408","description":"The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-5517","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-5517","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-5517","date":"2026-10-19","epss":0.01242,"percentile":0.68753}],"risk":0.9315,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-5517","description":"A flaw was found in the bind package which may result in a Denial of Service in `named` process. This is a result of a reachable assertion, leading `named` to prematurely terminate when both conditions are met: nxdomain-redirect for the queried domain is configured and the resolver receives a PTR query, used for a reverse DNS lookup, for a RFC 1918 address that would normally result in an authoritative `NXDOMAIN` response. A single query matching both conditions can lead to a Denial of Service in the named application."},"relatedVulnerabilities":[{"id":"CVE-2023-5517","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-5517","date":"2026-10-19","epss":0.01242,"percentile":0.68753}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/13/1","https://kb.isc.org/docs/cve-2023-5517","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://security.netapp.com/advisory/ntap-20240503-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5517","description":"A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect <domain>;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-5517","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-5517","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-5517","date":"2026-10-19","epss":0.01242,"percentile":0.68753}],"risk":0.9315,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-5517","description":"A flaw was found in the bind package which may result in a Denial of Service in `named` process. This is a result of a reachable assertion, leading `named` to prematurely terminate when both conditions are met: nxdomain-redirect for the queried domain is configured and the resolver receives a PTR query, used for a reverse DNS lookup, for a RFC 1918 address that would normally result in an authoritative `NXDOMAIN` response. A single query matching both conditions can lead to a Denial of Service in the named application."},"relatedVulnerabilities":[{"id":"CVE-2023-5517","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-5517","date":"2026-10-19","epss":0.01242,"percentile":0.68753}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/13/1","https://kb.isc.org/docs/cve-2023-5517","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://security.netapp.com/advisory/ntap-20240503-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5517","description":"A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect <domain>;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-5517","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-5517","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-5517","date":"2026-10-19","epss":0.01242,"percentile":0.68753}],"risk":0.9315,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-5517","description":"A flaw was found in the bind package which may result in a Denial of Service in `named` process. This is a result of a reachable assertion, leading `named` to prematurely terminate when both conditions are met: nxdomain-redirect for the queried domain is configured and the resolver receives a PTR query, used for a reverse DNS lookup, for a RFC 1918 address that would normally result in an authoritative `NXDOMAIN` response. A single query matching both conditions can lead to a Denial of Service in the named application."},"relatedVulnerabilities":[{"id":"CVE-2023-5517","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-5517","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-5517","date":"2026-10-19","epss":0.01242,"percentile":0.68753}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/13/1","https://kb.isc.org/docs/cve-2023-5517","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://security.netapp.com/advisory/ntap-20240503-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5517","description":"A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect <domain>;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-10-19","epss":0.02303,"percentile":0.83067}],"risk":0.89817,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7592","description":"A flaw was found in the `http.cookies` module in the Python package. When parsing cookies that contain backslashes, under certain circumstances, the module uses an algorithm with quadratic complexity, leading to excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-10-19","epss":0.02303,"percentile":0.83067}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-10-19","epss":0.02303,"percentile":0.83067}],"risk":0.89817,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7592","description":"A flaw was found in the `http.cookies` module in the Python package. When parsing cookies that contain backslashes, under certain circumstances, the module uses an algorithm with quadratic complexity, leading to excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-10-19","epss":0.02303,"percentile":0.83067}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-19","epss":0.01966,"percentile":0.80071}],"risk":0.8748700000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-19","epss":0.01966,"percentile":0.80071}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-19","epss":0.01966,"percentile":0.80071}],"risk":0.8748700000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-19","epss":0.01966,"percentile":0.80071}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"risk":0.83392,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"risk":0.83392,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"risk":0.83392,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"risk":0.83392,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"risk":0.83392,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-10-19","epss":0.01303,"percentile":0.70073}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84838","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84838","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"risk":0.7072,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."},"relatedVulnerabilities":[{"id":"CVE-2026-84838","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84838","https://bugzilla.redhat.com/show_bug.cgi?id=2462222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84838","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84838","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"risk":0.7072,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."},"relatedVulnerabilities":[{"id":"CVE-2026-84838","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84838","https://bugzilla.redhat.com/show_bug.cgi?id=2462222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84838","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84838","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"risk":0.7072,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."},"relatedVulnerabilities":[{"id":"CVE-2026-84838","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84838","https://bugzilla.redhat.com/show_bug.cgi?id=2462222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84838","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84838","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"risk":0.7072,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."},"relatedVulnerabilities":[{"id":"CVE-2026-84838","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84838","https://bugzilla.redhat.com/show_bug.cgi?id=2462222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84838","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84838","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"risk":0.7072,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."},"relatedVulnerabilities":[{"id":"CVE-2026-84838","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84838","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84838","date":"2026-10-19","epss":0.01105,"percentile":0.6529}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84838","https://bugzilla.redhat.com/show_bug.cgi?id=2462222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84838","description":"A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-12243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-12243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-10-19","epss":0.01292,"percentile":0.69836}],"risk":0.66538,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-12243","description":"A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2024-12243","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-10-19","epss":0.01292,"percentile":0.69836}],"urls":["https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:4051","https://access.redhat.com/errata/RHSA-2025:7076","https://access.redhat.com/errata/RHSA-2025:8020","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-12243","https://bugzilla.redhat.com/show_bug.cgi?id=2344615","https://gitlab.com/gnutls/gnutls/-/issues/1553","https://gitlab.com/gnutls/libtasn1/-/issues/52","https://lists.debian.org/debian-lts-announce/2025/02/msg00027.html","https://security.netapp.com/advisory/ntap-20250523-0002/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12243","description":"A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-9232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-10-19","epss":0.02001,"percentile":0.80464}],"risk":0.610305,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9232","description":"A flaw was found in the OpenSSL HTTP client API no_proxy handling. This vulnerability allows an application level denial of service (application crash) via an attacker-controlled IPv6 URL when the no_proxy environment variable is set."},"relatedVulnerabilities":[{"id":"CVE-2025-9232","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9232","date":"2026-10-19","epss":0.02001,"percentile":0.80464}],"urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"ee20a0d6e984ac85","cpes":["cpe:2.3:a:libtasn1:libtasn1:4.20.0-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtasn1:4.20.0-5.el10_2:*:*:*:*:*:*:*"],"name":"libtasn1","purl":"pkg:rpm/redhat/libtasn1@4.20.0-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libtasn1-4.20.0-5.el10_2.src.rpm","type":"rpm","version":"4.20.0-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-12133","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libtasn1","version":"0:4.20.0-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-12133","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-10-19","epss":0.0111,"percentile":0.6541}],"risk":0.57165,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-12133","description":"A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack."},"relatedVulnerabilities":[{"id":"CVE-2024-12133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-10-19","epss":0.0111,"percentile":0.6541}],"urls":["https://access.redhat.com/errata/RHSA-2025:17347","https://access.redhat.com/errata/RHSA-2025:4049","https://access.redhat.com/errata/RHSA-2025:7077","https://access.redhat.com/errata/RHSA-2025:8021","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/security/cve/CVE-2024-12133","https://bugzilla.redhat.com/show_bug.cgi?id=2344611","https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md","https://gitlab.com/gnutls/libtasn1/-/issues/52","http://www.openwall.com/lists/oss-security/2025/02/06/6","https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html","https://security.netapp.com/advisory/ntap-20250523-0003/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12133","description":"A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42307","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42307","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-19","epss":0.01172,"percentile":0.66973}],"risk":0.55084,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42307","description":"A flaw was found in Vim’s netrw plugin. Improper sanitization of specially crafted filenames or URLs could allow shell metacharacters to be included in temporary filenames passed to external commands. A local attacker could exploit this issue to trigger unintended shell command execution when a user opens malicious content using affected netrw functionality."},"relatedVulnerabilities":[{"id":"CVE-2026-42307","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-19","epss":0.01172,"percentile":0.66973}],"urls":["https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc","https://github.com/vim/vim/releases/tag/v9.2.0383","https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42307","description":"Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42307","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42307","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-19","epss":0.01172,"percentile":0.66973}],"risk":0.55084,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42307","description":"A flaw was found in Vim’s netrw plugin. Improper sanitization of specially crafted filenames or URLs could allow shell metacharacters to be included in temporary filenames passed to external commands. A local attacker could exploit this issue to trigger unintended shell command execution when a user opens malicious content using affected netrw functionality."},"relatedVulnerabilities":[{"id":"CVE-2026-42307","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-19","epss":0.01172,"percentile":0.66973}],"urls":["https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc","https://github.com/vim/vim/releases/tag/v9.2.0383","https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42307","description":"Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-10-19","epss":0.00955,"percentile":0.60749}],"risk":0.520475,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."},"relatedVulnerabilities":[{"id":"CVE-2026-0990","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-10-19","epss":0.00955,"percentile":0.60749}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0990","https://bugzilla.redhat.com/show_bug.cgi?id=2429959","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-19","epss":0.00655,"percentile":0.50451}],"risk":0.5109,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92392","description":"A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-19","epss":0.00655,"percentile":0.50451}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-19","epss":0.00655,"percentile":0.50451}],"risk":0.5109,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92392","description":"A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-19","epss":0.00655,"percentile":0.50451}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"473fece84d4e5a84","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@23.3.2-11.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-pip-23.3.2-11.el10_2.src.rpm","type":"rpm","version":"23.3.2-11.el10_2","language":"","licenses":["MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"23.3.2-11.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-47081","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-pip","version":"23.3.2-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-47081","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47081","date":"2026-10-19","epss":0.0098,"percentile":0.61604}],"risk":0.5047,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-47081","description":"A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue."},"relatedVulnerabilities":[{"id":"CVE-2024-47081","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47081","date":"2026-10-19","epss":0.0098,"percentile":0.61604}],"urls":["https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef","https://github.com/psf/requests/pull/6965","https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7","https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env","https://seclists.org/fulldisclosure/2025/Jun/2","http://seclists.org/fulldisclosure/2025/Jun/2","http://www.openwall.com/lists/oss-security/2025/06/03/11","http://www.openwall.com/lists/oss-security/2025/06/03/9","http://www.openwall.com/lists/oss-security/2025/06/04/1","http://www.openwall.com/lists/oss-security/2025/06/04/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081","description":"Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41996","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-41996","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-10-19","epss":0.01083,"percentile":0.64664}],"risk":0.481935,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41996","description":"A vulnerability was found in the Diffie-Hellman Ephemeral (DHE) Key Agreement Protocol, where a malicious client can exploit the server's public key validation process. By forcing the server to use DHE and validating the order of public keys, the client can trigger expensive server-side modular exponentiation calculations. This issue results in asymmetric resource consumption, potentially leading to a denial of service (DoS) attack by overwhelming the server with computationally intensive operations."},"relatedVulnerabilities":[{"id":"CVE-2024-41996","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-10-19","epss":0.01083,"percentile":0.64664}],"urls":["https://dheatattack.gitlab.io/details/","https://dheatattack.gitlab.io/faq/","https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4603","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-4603","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4603","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-4603","cwe":"CWE-834","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4603","date":"2026-10-19","epss":0.01131,"percentile":0.65924}],"risk":0.46936500000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-4603","description":"A flaw was found in OpenSSL. Applications that use the EVP_PKEY_param_check() or EVP_PKEY_public_check() function to check a DSA public key or DSA parameters may experience long delays when checking excessively long DSA keys or parameters.  In applications that allow untrusted sources to provide the key or parameters that are checked, an attacker may be able to cause a denial of service. These functions are not called by OpenSSL on untrusted DSA keys. The applications that directly call these functions are the ones that may be vulnerable to this issue."},"relatedVulnerabilities":[{"id":"CVE-2024-4603","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4603","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-4603","cwe":"CWE-834","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4603","date":"2026-10-19","epss":0.01131,"percentile":0.65924}],"urls":["https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397","https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e","https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d","https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740","https://www.openssl.org/news/secadv/20240516.txt","http://www.openwall.com/lists/oss-security/2024/05/16/2","https://security.netapp.com/advisory/ntap-20240621-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4603","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7774","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7774","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-10-19","epss":0.00781,"percentile":0.5517}],"risk":0.449075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7774","description":"A flaw was found in the `tarfile.data_filter` function within the Python `tarfile` module. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive containing malicious link entries, such as symlinks with empty or directory-like names. This bypass allows the attacker to redirect subsequent archive members outside the intended extraction directory, leading to arbitrary file writes on the system where the archive is extracted. The impact of this flaw is limited by the permissions of the extracting process."},"relatedVulnerabilities":[{"id":"CVE-2026-7774","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-10-19","epss":0.00781,"percentile":0.5517}],"urls":["https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2","https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d","https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc","https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da","https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558","https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf","https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609","https://github.com/python/cpython/issues/149486","https://github.com/python/cpython/pull/149487","https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/","http://www.openwall.com/lists/oss-security/2026/06/04/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7774","description":"tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7774","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7774","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-10-19","epss":0.00781,"percentile":0.5517}],"risk":0.449075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7774","description":"A flaw was found in the `tarfile.data_filter` function within the Python `tarfile` module. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive containing malicious link entries, such as symlinks with empty or directory-like names. This bypass allows the attacker to redirect subsequent archive members outside the intended extraction directory, leading to arbitrary file writes on the system where the archive is extracted. The impact of this flaw is limited by the permissions of the extracting process."},"relatedVulnerabilities":[{"id":"CVE-2026-7774","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-10-19","epss":0.00781,"percentile":0.5517}],"urls":["https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2","https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d","https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc","https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da","https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558","https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf","https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609","https://github.com/python/cpython/issues/149486","https://github.com/python/cpython/pull/149487","https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/","http://www.openwall.com/lists/oss-security/2026/06/04/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7774","description":"tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-19","epss":0.00549,"percentile":0.44829}],"risk":0.430965,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77214","description":"A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application."},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-19","epss":0.00549,"percentile":0.44829}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-19","epss":0.00747,"percentile":0.54031}],"risk":0.42952499999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19931","description":"A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-19","epss":0.00747,"percentile":0.54031}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-19","epss":0.00747,"percentile":0.54031}],"risk":0.42952499999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19931","description":"A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-19","epss":0.00747,"percentile":0.54031}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44656","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44656","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-19","epss":0.00808,"percentile":0.56119}],"risk":0.41612000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44656","description":"A flaw was found in Vim, an open-source command-line text editor. An attacker who controls the contents of a file can exploit an OS command injection vulnerability in Vim's `:find` command-line completion. This occurs when the `path` option, which can be set from a modeline, contains backtick-enclosed shell commands. These commands are then executed when a user opens the malicious file and triggers `:find` completion, leading to arbitrary command execution."},"relatedVulnerabilities":[{"id":"CVE-2026-44656","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-19","epss":0.00808,"percentile":0.56119}],"urls":["https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0","https://github.com/vim/vim/releases/tag/v9.2.0435","https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44656","description":"Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44656","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44656","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-19","epss":0.00808,"percentile":0.56119}],"risk":0.41612000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44656","description":"A flaw was found in Vim, an open-source command-line text editor. An attacker who controls the contents of a file can exploit an OS command injection vulnerability in Vim's `:find` command-line completion. This occurs when the `path` option, which can be set from a modeline, contains backtick-enclosed shell commands. These commands are then executed when a user opens the malicious file and triggers `:find` completion, leading to arbitrary command execution."},"relatedVulnerabilities":[{"id":"CVE-2026-44656","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-19","epss":0.00808,"percentile":0.56119}],"urls":["https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0","https://github.com/vim/vim/releases/tag/v9.2.0435","https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44656","description":"Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-19","epss":0.00715,"percentile":0.5289}],"risk":0.41112499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11972","description":"A flaw was found in the Python `tarfile` module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the `tarfile` module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives."},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-19","epss":0.00715,"percentile":0.5289}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-19","epss":0.00715,"percentile":0.5289}],"risk":0.41112499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11972","description":"A flaw was found in the Python `tarfile` module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the `tarfile` module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives."},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-19","epss":0.00715,"percentile":0.5289}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5950","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5950","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5950","cwe":"CWE-606","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-5950","date":"2026-10-19","epss":0.00798,"percentile":0.55748}],"risk":0.41097,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5950","description":"A flaw was found in BIND 9. A remote, unauthenticated attacker can exploit an unbounded resend loop vulnerability in the resolver state machine during bad-server handling. By sending specially crafted queries that trigger specific retry conditions, the attacker can cause severe resource exhaustion, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-5950","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5950","cwe":"CWE-606","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-5950","date":"2026-10-19","epss":0.00798,"percentile":0.55748}],"urls":["https://downloads.isc.org/isc/bind9/9.18.49","https://downloads.isc.org/isc/bind9/9.20.23","https://downloads.isc.org/isc/bind9/9.21.22","https://kb.isc.org/docs/cve-2026-5950"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5950","description":"An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions.\nThis issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5950","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5950","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5950","cwe":"CWE-606","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-5950","date":"2026-10-19","epss":0.00798,"percentile":0.55748}],"risk":0.41097,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5950","description":"A flaw was found in BIND 9. A remote, unauthenticated attacker can exploit an unbounded resend loop vulnerability in the resolver state machine during bad-server handling. By sending specially crafted queries that trigger specific retry conditions, the attacker can cause severe resource exhaustion, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-5950","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5950","cwe":"CWE-606","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-5950","date":"2026-10-19","epss":0.00798,"percentile":0.55748}],"urls":["https://downloads.isc.org/isc/bind9/9.18.49","https://downloads.isc.org/isc/bind9/9.20.23","https://downloads.isc.org/isc/bind9/9.21.22","https://kb.isc.org/docs/cve-2026-5950"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5950","description":"An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions.\nThis issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5950","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5950","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5950","cwe":"CWE-606","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-5950","date":"2026-10-19","epss":0.00798,"percentile":0.55748}],"risk":0.41097,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5950","description":"A flaw was found in BIND 9. A remote, unauthenticated attacker can exploit an unbounded resend loop vulnerability in the resolver state machine during bad-server handling. By sending specially crafted queries that trigger specific retry conditions, the attacker can cause severe resource exhaustion, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-5950","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5950","cwe":"CWE-606","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-5950","date":"2026-10-19","epss":0.00798,"percentile":0.55748}],"urls":["https://downloads.isc.org/isc/bind9/9.18.49","https://downloads.isc.org/isc/bind9/9.20.23","https://downloads.isc.org/isc/bind9/9.21.22","https://kb.isc.org/docs/cve-2026-5950"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5950","description":"An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions.\nThis issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9546","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-9546","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-10-19","epss":0.00652,"percentile":0.50301}],"risk":0.4075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9546","description":"A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers."},"relatedVulnerabilities":[{"id":"CVE-2026-9546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-10-19","epss":0.00652,"percentile":0.50301}],"urls":["https://curl.se/docs/CVE-2026-9546.html","https://curl.se/docs/CVE-2026-9546.json","https://hackerone.com/reports/3754343"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","description":"A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9546","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-9546","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-10-19","epss":0.00652,"percentile":0.50301}],"risk":0.4075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9546","description":"A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers."},"relatedVulnerabilities":[{"id":"CVE-2026-9546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-10-19","epss":0.00652,"percentile":0.50301}],"urls":["https://curl.se/docs/CVE-2026-9546.html","https://curl.se/docs/CVE-2026-9546.json","https://hackerone.com/reports/3754343"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","description":"A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-19","epss":0.00885,"percentile":0.58563}],"risk":0.3938250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28388","description":"A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-19","epss":0.00885,"percentile":0.58563}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39881","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-39881","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-19","epss":0.00761,"percentile":0.54511}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-39881","description":"A flaw was found in Vim. A command injection vulnerability in Vim's NetBeans interface allows a malicious NetBeans server to execute arbitrary Ex commands when Vim connects to it. This occurs due to unsanitized strings in the defineAnnoType and specialKeys protocol messages, leading to arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-39881","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-19","epss":0.00761,"percentile":0.54511}],"urls":["https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19","https://github.com/vim/vim/releases/tag/v9.2.0316","https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39881","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-39881","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-19","epss":0.00761,"percentile":0.54511}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-39881","description":"A flaw was found in Vim. A command injection vulnerability in Vim's NetBeans interface allows a malicious NetBeans server to execute arbitrary Ex commands when Vim connects to it. This occurs due to unsanitized strings in the defineAnnoType and specialKeys protocol messages, leading to arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-39881","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-19","epss":0.00761,"percentile":0.54511}],"urls":["https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19","https://github.com/vim/vim/releases/tag/v9.2.0316","https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316."}]},{"artifact":{"id":"473fece84d4e5a84","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@23.3.2-11.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-pip-23.3.2-11.el10_2.src.rpm","type":"rpm","version":"23.3.2-11.el10_2","language":"","licenses":["MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"23.3.2-11.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32284","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-pip","version":"23.3.2-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-32284","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32284","date":"2026-10-19","epss":0.00695,"percentile":0.52098}],"risk":0.378775,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32284","description":"A flaw was found in the msgpack decoder. A remote attacker could send specially crafted, truncated fixext data to an application using the msgpack library. This improper input validation can lead to an out-of-bounds read and a runtime panic, resulting in a denial of service (DoS) attack against the application."},"relatedVulnerabilities":[{"id":"CVE-2026-32284","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32284","date":"2026-10-19","epss":0.00695,"percentile":0.52098}],"urls":["https://github.com/golang/vulndb/issues/4513","https://github.com/shamaton/msgpack/issues/59","https://pkg.go.dev/vuln/GO-2026-4513","https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32284","description":"The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-19","epss":0.00657,"percentile":0.5051}],"risk":0.37777499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-19","epss":0.00657,"percentile":0.5051}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-19","epss":0.00657,"percentile":0.5051}],"risk":0.37777499999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-19","epss":0.00657,"percentile":0.5051}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-28834","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-28834","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28834","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28834","date":"2026-10-19","epss":0.00724,"percentile":0.53205}],"risk":0.37285999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-28834","description":"A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel."},"relatedVulnerabilities":[{"id":"CVE-2024-28834","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28834","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28834","date":"2026-10-19","epss":0.00724,"percentile":0.53205}],"urls":["https://access.redhat.com/errata/RHSA-2024:1784","https://access.redhat.com/errata/RHSA-2024:1879","https://access.redhat.com/errata/RHSA-2024:1997","https://access.redhat.com/errata/RHSA-2024:2044","https://access.redhat.com/errata/RHSA-2024:2570","https://access.redhat.com/errata/RHSA-2024:2889","https://access.redhat.com/security/cve/CVE-2024-28834","https://bugzilla.redhat.com/show_bug.cgi?id=2269228","https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html","https://minerva.crocs.fi.muni.cz/","http://www.openwall.com/lists/oss-security/2024/03/22/1","http://www.openwall.com/lists/oss-security/2024/03/22/2","https://lists.debian.org/debian-lts-announce/2024/09/msg00019.html","https://people.redhat.com/~hkario/marvin/","https://security.netapp.com/advisory/ntap-20240524-0004/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28834","description":"A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"risk":0.37184,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"risk":0.37184,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"risk":0.37184,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"risk":0.37184,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"risk":0.37184,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-10-19","epss":0.00581,"percentile":0.46722}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-19","epss":0.00719,"percentile":0.53051}],"risk":0.37028500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-19","epss":0.00719,"percentile":0.53051}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-19","epss":0.00719,"percentile":0.53051}],"risk":0.37028500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-19","epss":0.00719,"percentile":0.53051}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-79824","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-79824","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79824","cwe":"CWE-30","type":"Secondary","source":"security-alert@hpe.com"}],"epss":[{"cve":"CVE-2026-79824","date":"2026-10-19","epss":0.00483,"percentile":0.40329}],"risk":0.369495,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-79824","description":"A flaw was found in Python. An attacker can exploit this directory traversal vulnerability by providing a specially crafted TAR archive containing relative path sequences, such as dot-dot notation. When the archive is extracted, files can be written outside the intended extraction directory, allowing arbitrary files to be overwritten and potentially compromising system integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-79824","cvss":[{"type":"Secondary","source":"security-alert@hpe.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79824","cwe":"CWE-30","type":"Secondary","source":"security-alert@hpe.com"}],"epss":[{"cve":"CVE-2026-79824","date":"2026-10-19","epss":0.00483,"percentile":0.40329}],"urls":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-79824","description":"A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-79824","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-79824","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79824","cwe":"CWE-30","type":"Secondary","source":"security-alert@hpe.com"}],"epss":[{"cve":"CVE-2026-79824","date":"2026-10-19","epss":0.00483,"percentile":0.40329}],"risk":0.369495,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-79824","description":"A flaw was found in Python. An attacker can exploit this directory traversal vulnerability by providing a specially crafted TAR archive containing relative path sequences, such as dot-dot notation. When the archive is extracted, files can be written outside the intended extraction directory, allowing arbitrary files to be overwritten and potentially compromising system integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-79824","cvss":[{"type":"Secondary","source":"security-alert@hpe.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79824","cwe":"CWE-30","type":"Secondary","source":"security-alert@hpe.com"}],"epss":[{"cve":"CVE-2026-79824","date":"2026-10-19","epss":0.00483,"percentile":0.40329}],"urls":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-79824","description":"A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-19","epss":0.00805,"percentile":0.55999}],"risk":0.358225,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28389","description":"A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data."},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-19","epss":0.00805,"percentile":0.55999}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-19","epss":0.00672,"percentile":0.51147}],"risk":0.34608000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7210","description":"A flaw was found in the `python` and `expat` components. Insufficient entropy in the hash-flooding protection mechanism of `xml.parsers.expat` and `xml.etree.ElementTree` allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a denial of service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-19","epss":0.00672,"percentile":0.51147}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-19","epss":0.00672,"percentile":0.51147}],"risk":0.34608000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7210","description":"A flaw was found in the `python` and `expat` components. Insufficient entropy in the hash-flooding protection mechanism of `xml.parsers.expat` and `xml.etree.ElementTree` allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a denial of service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-19","epss":0.00672,"percentile":0.51147}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3119","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3119","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3119","date":"2026-10-19","epss":0.00598,"percentile":0.47607}],"risk":0.34385,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3119","description":"A flaw was found in BIND, specifically within the `named` daemon. An authenticated remote attacker, possessing a valid Transaction Signature (TSIG) key configured on the server, could send a specially crafted query containing a TKEY record. This action may cause the `named` daemon to crash, leading to a Denial of Service (DoS) for the affected DNS service."},"relatedVulnerabilities":[{"id":"CVE-2026-3119","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3119","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3119","date":"2026-10-19","epss":0.00598,"percentile":0.47607}],"urls":["https://downloads.isc.org/isc/bind9/9.20.21","https://downloads.isc.org/isc/bind9/9.21.20","https://kb.isc.org/docs/cve-2026-3119"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3119","description":"Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3119","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3119","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3119","date":"2026-10-19","epss":0.00598,"percentile":0.47607}],"risk":0.34385,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3119","description":"A flaw was found in BIND, specifically within the `named` daemon. An authenticated remote attacker, possessing a valid Transaction Signature (TSIG) key configured on the server, could send a specially crafted query containing a TKEY record. This action may cause the `named` daemon to crash, leading to a Denial of Service (DoS) for the affected DNS service."},"relatedVulnerabilities":[{"id":"CVE-2026-3119","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3119","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3119","date":"2026-10-19","epss":0.00598,"percentile":0.47607}],"urls":["https://downloads.isc.org/isc/bind9/9.20.21","https://downloads.isc.org/isc/bind9/9.21.20","https://kb.isc.org/docs/cve-2026-3119"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3119","description":"Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3119","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3119","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3119","date":"2026-10-19","epss":0.00598,"percentile":0.47607}],"risk":0.34385,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3119","description":"A flaw was found in BIND, specifically within the `named` daemon. An authenticated remote attacker, possessing a valid Transaction Signature (TSIG) key configured on the server, could send a specially crafted query containing a TKEY record. This action may cause the `named` daemon to crash, leading to a Denial of Service (DoS) for the affected DNS service."},"relatedVulnerabilities":[{"id":"CVE-2026-3119","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3119","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3119","date":"2026-10-19","epss":0.00598,"percentile":0.47607}],"urls":["https://downloads.isc.org/isc/bind9/9.20.21","https://downloads.isc.org/isc/bind9/9.21.20","https://kb.isc.org/docs/cve-2026-3119"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3119","description":"Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4426","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4426","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-10-19","epss":0.00582,"percentile":0.4677}],"risk":0.33464999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-4426","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-10-19","epss":0.00582,"percentile":0.4677}],"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-4426","https://bugzilla.redhat.com/show_bug.cgi?id=2449010","https://github.com/libarchive/libarchive/pull/2897"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.12.15-1.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"< 0:3.12.15-1.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"fixed","versions":["0:3.12.15-1.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:3.12.15-1.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-19","epss":0.00429,"percentile":0.35811}],"risk":0.33462000000000003,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:77020","link":"https://access.redhat.com/errata/RHSA-2026:77020"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19445","description":"A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-19","epss":0.00429,"percentile":0.35811}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.12.15-1.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"< 0:3.12.15-1.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"fixed","versions":["0:3.12.15-1.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:3.12.15-1.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-19","epss":0.00429,"percentile":0.35811}],"risk":0.33462000000000003,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:77020","link":"https://access.redhat.com/errata/RHSA-2026:77020"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19445","description":"A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-19","epss":0.00429,"percentile":0.35811}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59871","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-59871","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59871","date":"2026-10-19","epss":0.00644,"percentile":0.49901}],"risk":0.33166,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59871","description":"A flaw was found in node-tar, a library for manipulating tar archives in Node.js. This vulnerability occurs when the library incorrectly converts specific archive path values into numbers, leading to an error during subsequent path processing. An attacker could exploit this to cause the application using node-tar to crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-59871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59871","date":"2026-10-19","epss":0.00644,"percentile":0.49901}],"urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-19","epss":0.0068,"percentile":0.51539}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-19","epss":0.0068,"percentile":0.51539}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-19","epss":0.0068,"percentile":0.51539}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-19","epss":0.0068,"percentile":0.51539}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-27113","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-27113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-10-19","epss":0.01053,"percentile":0.63823}],"risk":0.321165,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-27113","description":"A flaw was found in libxml2. This vulnerability allows a NULL pointer dereference, leading to a potential crash or denial of service via a crafted XML pattern."},"relatedVulnerabilities":[{"id":"CVE-2025-27113","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-10-19","epss":0.01053,"percentile":0.63823}],"urls":["https://gitlab.gnome.org/GNOME/libxml2/-/issues/861","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://security.netapp.com/advisory/ntap-20250306-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27113","description":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"risk":0.30928999999999995,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86145","description":"A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system."},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"risk":0.30928999999999995,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86145","description":"A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system."},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26269","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-26269","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26269","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-26269","date":"2026-10-19","epss":0.00584,"percentile":0.46891}],"risk":0.30660000000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-26269","description":"A flaw was found in Vim. A stack-based buffer overflow in the NetBeans integration can be triggered in the special_keys function in the src/netbeans.c file via a malicious NetBeans server due to improper bounds checking, most likely resulting in a denial of service or in arbitrary command execution."},"relatedVulnerabilities":[{"id":"CVE-2026-26269","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26269","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-26269","date":"2026-10-19","epss":0.00584,"percentile":0.46891}],"urls":["https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970","https://github.com/vim/vim/releases/tag/v9.1.2148","https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68","http://www.openwall.com/lists/oss-security/2026/02/13/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26269","description":"Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26269","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-26269","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26269","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-26269","date":"2026-10-19","epss":0.00584,"percentile":0.46891}],"risk":0.30660000000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-26269","description":"A flaw was found in Vim. A stack-based buffer overflow in the NetBeans integration can be triggered in the special_keys function in the src/netbeans.c file via a malicious NetBeans server due to improper bounds checking, most likely resulting in a denial of service or in arbitrary command execution."},"relatedVulnerabilities":[{"id":"CVE-2026-26269","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26269","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-26269","date":"2026-10-19","epss":0.00584,"percentile":0.46891}],"urls":["https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970","https://github.com/vim/vim/releases/tag/v9.1.2148","https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68","http://www.openwall.com/lists/oss-security/2026/02/13/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26269","description":"Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-19","epss":0.0055,"percentile":0.44881}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-19","epss":0.0055,"percentile":0.44881}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-19","epss":0.0055,"percentile":0.44881}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-19","epss":0.0055,"percentile":0.44881}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-19","epss":0.00494,"percentile":0.4115}],"risk":0.30380999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9080","description":"A flaw was found in libcurl. When `curl_easy_pause()` is called within the event-based `CURLMOPT_SOCKETFUNCTION` callback, a use-after-free vulnerability is triggered. This occurs because libcurl attempts to store a flag using a pointer to memory that has already been freed. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-19","epss":0.00494,"percentile":0.4115}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-19","epss":0.00494,"percentile":0.4115}],"risk":0.30380999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9080","description":"A flaw was found in libcurl. When `curl_easy_pause()` is called within the event-based `CURLMOPT_SOCKETFUNCTION` callback, a use-after-free vulnerability is triggered. This occurs because libcurl attempts to store a flag using a pointer to memory that has already been freed. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-19","epss":0.00494,"percentile":0.4115}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.12.15-1.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"< 0:3.12.15-1.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"fixed","versions":["0:3.12.15-1.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:3.12.15-1.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-19","epss":0.00401,"percentile":0.32907}],"risk":0.298745,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:77020","link":"https://access.redhat.com/errata/RHSA-2026:77020"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19553","description":"A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-19","epss":0.00401,"percentile":0.32907}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.12.15-1.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"< 0:3.12.15-1.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"fixed","versions":["0:3.12.15-1.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:3.12.15-1.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-19","epss":0.00401,"percentile":0.32907}],"risk":0.298745,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:77020","link":"https://access.redhat.com/errata/RHSA-2026:77020"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19553","description":"A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-19","epss":0.00401,"percentile":0.32907}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-19","epss":0.00519,"percentile":0.42923}],"risk":0.298425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-19","epss":0.00519,"percentile":0.42923}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-19","epss":0.00519,"percentile":0.42923}],"risk":0.298425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-19","epss":0.00519,"percentile":0.42923}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.5,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-19","epss":0.00616,"percentile":0.48495}],"risk":0.29259999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11468","description":"Missing character filtering has been discovered in Python. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-19","epss":0.00616,"percentile":0.48495}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.5,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-19","epss":0.00616,"percentile":0.48495}],"risk":0.29259999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11468","description":"Missing character filtering has been discovered in Python. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-19","epss":0.00616,"percentile":0.48495}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1:3.5.8-2.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 1:3.5.8-2.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["1:3.5.8-2.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"1:3.5.8-2.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-19","epss":0.0039,"percentile":0.31687}],"risk":0.29055,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76918","link":"https://access.redhat.com/errata/RHSA-2026:76918"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84782","description":"A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process."},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-19","epss":0.0039,"percentile":0.31687}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-10536","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-10536","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-19","epss":0.00598,"percentile":0.4759}],"risk":0.29002999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-10536","description":"A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-19","epss":0.00598,"percentile":0.4759}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10536","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-10536","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-19","epss":0.00598,"percentile":0.4759}],"risk":0.29002999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-10536","description":"A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-19","epss":0.00598,"percentile":0.4759}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-19","epss":0.00561,"percentile":0.45569}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-12781","description":"A flaw was found in the base64 module in the Python standard library. The b64decode, standard_b64decode and urlsafe_b64decode functions will always accept the '+' and '/' characters even when an alternative base64 alphabet is specified via the altchars parameter that excludes them. This input validation bypass allows malformed or unexpected data to pass through decoding filters, potentially causing logical errors or data integrity issues in applications relying on strict character sets."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-19","epss":0.00561,"percentile":0.45569}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-19","epss":0.00561,"percentile":0.45569}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-12781","description":"A flaw was found in the base64 module in the Python standard library. The b64decode, standard_b64decode and urlsafe_b64decode functions will always accept the '+' and '/' characters even when an alternative base64 alphabet is specified via the altchars parameter that excludes them. This input validation bypass allows malformed or unexpected data to pass through decoding filters, potentially causing logical errors or data integrity issues in applications relying on strict character sets."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-19","epss":0.00561,"percentile":0.45569}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-29087","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-29087","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-29087","date":"2026-10-19","epss":0.00523,"percentile":0.43181}],"risk":0.274575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-29087","description":"A flaw was found in SQLite. This vulnerability allows an attacker to cause an integer overflow via the concat_ws function."},"relatedVulnerabilities":[{"id":"CVE-2025-29087","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":3.2,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-29087","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-29087","date":"2026-10-19","epss":0.00523,"percentile":0.43181}],"urls":["https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a","https://sqlite.org/releaselog/3_49_1.html","https://www.sqlite.org/cves.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-994087.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-29087","description":"In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-19","epss":0.00589,"percentile":0.47126}],"risk":0.273885,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-6069","description":"A denial-of-service (DoS) vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource consumption, ultimately causing a denial-of-service condition in applications that rely on this parser."},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-19","epss":0.00589,"percentile":0.47126}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-19","epss":0.00589,"percentile":0.47126}],"risk":0.273885,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-6069","description":"A denial-of-service (DoS) vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource consumption, ultimately causing a denial-of-service condition in applications that rely on this parser."},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-19","epss":0.00589,"percentile":0.47126}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76641","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76641","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76641","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76641","date":"2026-10-19","epss":0.00353,"percentile":0.27521}],"risk":0.26475,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76641","description":"A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes."},"relatedVulnerabilities":[{"id":"CVE-2026-76641","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76641","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76641","date":"2026-10-19","epss":0.00353,"percentile":0.27521}],"urls":["https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf","https://github.com/libexpat/libexpat/pull/1331","https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76641","description":"Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-59875","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-59875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59875","date":"2026-10-19","epss":0.00507,"percentile":0.41997}],"risk":0.26110500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-59875","description":"A flaw was found in node-tar, a library for manipulating tar archives in Node.js. A remote attacker could craft a malicious archive containing null characters (NUL bytes) in its metadata. When this archive is processed, the unstripped null characters can cause the application to terminate unexpectedly, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-59875","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59875","date":"2026-10-19","epss":0.00507,"percentile":0.41997}],"urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17."}]},{"artifact":{"id":"e8e4e4186e95c503","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.3-10.el10_2?arch=x86_64&distro=rhel-10.2&upstream=krb5-1.21.3-10.el10_2.src.rpm","type":"rpm","version":"1.21.3-10.el10_2","language":"","licenses":["Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.3-10.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"krb5","version":"1.21.3-10.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107708","description":"A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center (KDC) to cause a Denial of Service (DoS). By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate (PAC), an attacker can trigger a NULL pointer dereference that crashes the KDC daemon, interrupting authentication services."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-19","epss":0.00408,"percentile":0.33625}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9545","description":"A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's certificate. This could lead to the disclosure of sensitive information to the attacker."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-19","epss":0.00408,"percentile":0.33625}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-19","epss":0.00408,"percentile":0.33625}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9545","description":"A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's certificate. This could lead to the disclosure of sensitive information to the attacker."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-19","epss":0.00408,"percentile":0.33625}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19662","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19662","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-19","epss":0.00464,"percentile":0.38873}],"risk":0.25288000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19662","description":"A flaw was found in BIND 9. A remote attacker can cause a `named` resolver to stop functioning (Denial of Service) by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive with particular timing, a use-after-free vulnerability is triggered, leading to the resolver's abortion."},"relatedVulnerabilities":[{"id":"CVE-2026-19662","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-19","epss":0.00464,"percentile":0.38873}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://kb.isc.org/docs/cve-2026-19662"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19662","description":"An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19662","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19662","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-19","epss":0.00464,"percentile":0.38873}],"risk":0.25288000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19662","description":"A flaw was found in BIND 9. A remote attacker can cause a `named` resolver to stop functioning (Denial of Service) by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive with particular timing, a use-after-free vulnerability is triggered, leading to the resolver's abortion."},"relatedVulnerabilities":[{"id":"CVE-2026-19662","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-19","epss":0.00464,"percentile":0.38873}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://kb.isc.org/docs/cve-2026-19662"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19662","description":"An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19662","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19662","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-19","epss":0.00464,"percentile":0.38873}],"risk":0.25288000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19662","description":"A flaw was found in BIND 9. A remote attacker can cause a `named` resolver to stop functioning (Denial of Service) by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive with particular timing, a use-after-free vulnerability is triggered, leading to the resolver's abortion."},"relatedVulnerabilities":[{"id":"CVE-2026-19662","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-19","epss":0.00464,"percentile":0.38873}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://kb.isc.org/docs/cve-2026-19662"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19662","description":"An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"18903e2417661546","cpes":["cpe:2.3:a:libgcc:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"risk":0.2513699999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"26b8f4fefa0b3ec4","cpes":["cpe:2.3:a:libgomp:libgomp:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgomp:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libgomp","purl":"pkg:rpm/redhat/libgomp@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"risk":0.2513699999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"7e1663f3df86ee06","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2021-46195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"risk":0.2513699999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-46195","description":"A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2021-46195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46195","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-46195","date":"2026-10-19","epss":0.00798,"percentile":0.55769}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources."}]},{"artifact":{"id":"0214d467056f818c","cpes":["cpe:2.3:a:python3-urllib3:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-urllib3:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_urllib3:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_urllib3:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*"],"name":"python3-urllib3","purl":"pkg:rpm/redhat/python3-urllib3@1.26.19-4.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-urllib3-1.26.19-4.el10_2.src.rpm","type":"rpm","version":"1.26.19-4.el10_2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-urllib3","version":"1.26.19-4.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97689","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-urllib3","version":"1.26.19-4.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97689","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97689","date":"2026-10-19","epss":0.00335,"percentile":0.25374}],"risk":0.25125,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97689","description":"A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application."},"relatedVulnerabilities":[{"id":"CVE-2026-97689","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97689","date":"2026-10-19","epss":0.00335,"percentile":0.25374}],"urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-19","epss":0.00486,"percentile":0.40553}],"risk":0.25028999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3276","description":"A flaw was found in the `unicodedata.normalize()` function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service (DoS) on the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-19","epss":0.00486,"percentile":0.40553}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-19","epss":0.00486,"percentile":0.40553}],"risk":0.25028999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3276","description":"A flaw was found in the `unicodedata.normalize()` function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service (DoS) on the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-19","epss":0.00486,"percentile":0.40553}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19668","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19668","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19668","cwe":"CWE-407","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19668","date":"2026-10-19","epss":0.0048,"percentile":0.40058}],"risk":0.24719999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19668","description":"A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this vulnerability by sending a large number of specially crafted, invalid DNSSEC (Domain Name System Security Extensions) records to a BIND recursive resolver. This could lead to excessive resource consumption, resulting in a Denial of Service (DoS) for the affected resolver."},"relatedVulnerabilities":[{"id":"CVE-2026-19668","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19668","cwe":"CWE-407","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19668","date":"2026-10-19","epss":0.0048,"percentile":0.40058}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19668"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19668","description":"A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record.  Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19668","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19668","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19668","cwe":"CWE-407","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19668","date":"2026-10-19","epss":0.0048,"percentile":0.40058}],"risk":0.24719999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19668","description":"A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this vulnerability by sending a large number of specially crafted, invalid DNSSEC (Domain Name System Security Extensions) records to a BIND recursive resolver. This could lead to excessive resource consumption, resulting in a Denial of Service (DoS) for the affected resolver."},"relatedVulnerabilities":[{"id":"CVE-2026-19668","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19668","cwe":"CWE-407","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19668","date":"2026-10-19","epss":0.0048,"percentile":0.40058}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19668"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19668","description":"A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record.  Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19668","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19668","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19668","cwe":"CWE-407","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19668","date":"2026-10-19","epss":0.0048,"percentile":0.40058}],"risk":0.24719999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19668","description":"A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this vulnerability by sending a large number of specially crafted, invalid DNSSEC (Domain Name System Security Extensions) records to a BIND recursive resolver. This could lead to excessive resource consumption, resulting in a Denial of Service (DoS) for the affected resolver."},"relatedVulnerabilities":[{"id":"CVE-2026-19668","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19668","cwe":"CWE-407","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19668","date":"2026-10-19","epss":0.0048,"percentile":0.40058}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19668"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19668","description":"A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record.  Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75029","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75029","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-19","epss":0.0048,"percentile":0.40057}],"risk":0.24719999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75029","description":"A flaw was found in BIND 9. A remote attacker could send multiple copies of a single record in a query response to the `named` service. This could lead to increased memory usage in the negative cache, potentially causing a Denial of Service (DoS) due to memory exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-75029","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-19","epss":0.0048,"percentile":0.40057}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-75029"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75029","description":"In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75029","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75029","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-19","epss":0.0048,"percentile":0.40057}],"risk":0.24719999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75029","description":"A flaw was found in BIND 9. A remote attacker could send multiple copies of a single record in a query response to the `named` service. This could lead to increased memory usage in the negative cache, potentially causing a Denial of Service (DoS) due to memory exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-75029","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-19","epss":0.0048,"percentile":0.40057}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-75029"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75029","description":"In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75029","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75029","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-19","epss":0.0048,"percentile":0.40057}],"risk":0.24719999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75029","description":"A flaw was found in BIND 9. A remote attacker could send multiple copies of a single record in a query response to the `named` service. This could lead to increased memory usage in the negative cache, potentially causing a Denial of Service (DoS) due to memory exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-75029","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-19","epss":0.0048,"percentile":0.40057}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-75029"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75029","description":"In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"473fece84d4e5a84","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@23.3.2-11.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-pip-23.3.2-11.el10_2.src.rpm","type":"rpm","version":"23.3.2-11.el10_2","language":"","licenses":["MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"23.3.2-11.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50181","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-pip","version":"23.3.2-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-50181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50181","date":"2026-10-19","epss":0.00474,"percentile":0.39644}],"risk":0.24411000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-50181","description":"A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations."},"relatedVulnerabilities":[{"id":"CVE-2025-50181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50181","date":"2026-10-19","epss":0.00474,"percentile":0.39644}],"urls":["https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0."}]},{"artifact":{"id":"e8e4e4186e95c503","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.3-10.el10_2?arch=x86_64&distro=rhel-10.2&upstream=krb5-1.21.3-10.el10_2.src.rpm","type":"rpm","version":"1.21.3-10.el10_2","language":"","licenses":["Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.3-10.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"krb5","version":"1.21.3-10.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.24379999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107778","description":"A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-19","epss":0.00472,"percentile":0.39468}],"risk":0.24308000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19672","description":"A flaw was found in the Python `tarfile` module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX (Portable Operating System Interface) platforms. This occurs when processing a specially crafted archive containing member names that use directory traversal sequences (e.g., `../`) to leave and then re-enter the target directory. While only empty directories are created outside the destination, this can lead to unintended file system modifications."},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-19","epss":0.00472,"percentile":0.39468}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-19","epss":0.00472,"percentile":0.39468}],"risk":0.24308000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19672","description":"A flaw was found in the Python `tarfile` module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX (Portable Operating System Interface) platforms. This occurs when processing a specially crafted archive containing member names that use directory traversal sequences (e.g., `../`) to leave and then re-enter the target directory. While only empty directories are created outside the destination, this can lead to unintended file system modifications."},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-19","epss":0.00472,"percentile":0.39468}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-19","epss":0.00471,"percentile":0.39436}],"risk":0.242565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-19","epss":0.00471,"percentile":0.39436}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-19","epss":0.00471,"percentile":0.39436}],"risk":0.242565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-19","epss":0.00471,"percentile":0.39436}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-10-19","epss":0.00481,"percentile":0.4013}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4360","description":"A flaw was found in the Python `Tarfile.extract()` function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the `filter` parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system."},"relatedVulnerabilities":[{"id":"CVE-2026-4360","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-10-19","epss":0.00481,"percentile":0.4013}],"urls":["https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92","https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0","https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301","https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a","https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f","https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44","https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e","https://github.com/python/cpython/issues/151987","https://github.com/python/cpython/pull/151988","https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4360","description":"In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-10-19","epss":0.00481,"percentile":0.4013}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4360","description":"A flaw was found in the Python `Tarfile.extract()` function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the `filter` parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system."},"relatedVulnerabilities":[{"id":"CVE-2026-4360","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-10-19","epss":0.00481,"percentile":0.4013}],"urls":["https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92","https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0","https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301","https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a","https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f","https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44","https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e","https://github.com/python/cpython/issues/151987","https://github.com/python/cpython/pull/151988","https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4360","description":"In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-19","epss":0.00414,"percentile":0.34234}],"risk":0.23804999999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-19","epss":0.00414,"percentile":0.34234}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.12.1-4.el10_2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"< 0:8.12.1-4.el10_2.7 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"fixed","versions":["0:8.12.1-4.el10_2.7"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:8.12.1-4.el10_2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-19","epss":0.00414,"percentile":0.34234}],"risk":0.23804999999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:80512","link":"https://access.redhat.com/errata/RHSA-2026:80512"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-19","epss":0.00414,"percentile":0.34234}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-19","epss":0.00462,"percentile":0.38743}],"risk":0.23793,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54873","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data transfers to keep these buffers allocated indefinitely. This behavior leads to excessive memory consumption and can exhaust available system resources."},"relatedVulnerabilities":[{"id":"CVE-2026-54873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-19","epss":0.00462,"percentile":0.38743}],"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-13176","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-10-19","epss":0.00613,"percentile":0.48363}],"risk":0.23600500000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-13176","description":"A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected."},"relatedVulnerabilities":[{"id":"CVE-2024-13176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":3.4,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-10-19","epss":0.00613,"percentile":0.48363}],"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"473fece84d4e5a84","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@23.3.2-11.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-pip-23.3.2-11.el10_2.src.rpm","type":"rpm","version":"23.3.2-11.el10_2","language":"","licenses":["MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"23.3.2-11.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-pip","version":"23.3.2-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-45409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45409","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45409","date":"2026-10-19","epss":0.00457,"percentile":0.38275}],"risk":0.23535500000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45409","description":"A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2026-45409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45409","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45409","date":"2026-10-19","epss":0.00457,"percentile":0.38275}],"urls":["https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409","description":"Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-19","epss":0.00671,"percentile":0.51123}],"risk":0.22478499999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28387","description":"A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records."},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-19","epss":0.00671,"percentile":0.51123}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10822","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-10822","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10822","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-10822","cwe":"CWE-1284","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-10822","date":"2026-10-19","epss":0.00381,"percentile":0.30633}],"risk":0.219075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-10822","description":"If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.\nBIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing."},"relatedVulnerabilities":[{"id":"CVE-2026-10822","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10822","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-10822","cwe":"CWE-1284","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-10822","date":"2026-10-19","epss":0.00381,"percentile":0.30633}],"urls":["https://downloads.isc.org/isc/bind9/9.20.26","https://downloads.isc.org/isc/bind9/9.21.24","https://kb.isc.org/docs/cve-2026-10822"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10822","description":"If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.\n\nBIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10822","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-10822","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10822","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-10822","cwe":"CWE-1284","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-10822","date":"2026-10-19","epss":0.00381,"percentile":0.30633}],"risk":0.219075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-10822","description":"If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.\nBIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing."},"relatedVulnerabilities":[{"id":"CVE-2026-10822","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10822","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-10822","cwe":"CWE-1284","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-10822","date":"2026-10-19","epss":0.00381,"percentile":0.30633}],"urls":["https://downloads.isc.org/isc/bind9/9.20.26","https://downloads.isc.org/isc/bind9/9.21.24","https://kb.isc.org/docs/cve-2026-10822"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10822","description":"If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.\n\nBIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10822","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-10822","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10822","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-10822","cwe":"CWE-1284","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-10822","date":"2026-10-19","epss":0.00381,"percentile":0.30633}],"risk":0.219075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-10822","description":"If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.\nBIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing."},"relatedVulnerabilities":[{"id":"CVE-2026-10822","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10822","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-10822","cwe":"CWE-1284","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-10822","date":"2026-10-19","epss":0.00381,"percentile":0.30633}],"urls":["https://downloads.isc.org/isc/bind9/9.20.26","https://downloads.isc.org/isc/bind9/9.21.24","https://kb.isc.org/docs/cve-2026-10822"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10822","description":"If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.\n\nBIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42765","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42765","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-10-19","epss":0.00477,"percentile":0.39828}],"risk":0.21226500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42765","description":"A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-42765","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-10-19","epss":0.00477,"percentile":0.39828}],"urls":["https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334","https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","description":"Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3592","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3592","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3592","cwe":"CWE-408","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3592","date":"2026-10-19","epss":0.00406,"percentile":0.33372}],"risk":0.20909000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3592","description":"A flaw was found in BIND resolvers. A remote attacker could exploit this vulnerability by sending a query to a specially crafted zone. This would cause the resolver to consume disproportionate resources, leading to a denial of service (DoS) due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-3592","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3592","cwe":"CWE-408","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3592","date":"2026-10-19","epss":0.00406,"percentile":0.33372}],"urls":["https://downloads.isc.org/isc/bind9/9.18.49","https://downloads.isc.org/isc/bind9/9.20.23","https://downloads.isc.org/isc/bind9/9.21.22","https://kb.isc.org/docs/cve-2026-3592"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3592","description":"BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3592","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3592","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3592","cwe":"CWE-408","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3592","date":"2026-10-19","epss":0.00406,"percentile":0.33372}],"risk":0.20909000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3592","description":"A flaw was found in BIND resolvers. A remote attacker could exploit this vulnerability by sending a query to a specially crafted zone. This would cause the resolver to consume disproportionate resources, leading to a denial of service (DoS) due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-3592","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3592","cwe":"CWE-408","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3592","date":"2026-10-19","epss":0.00406,"percentile":0.33372}],"urls":["https://downloads.isc.org/isc/bind9/9.18.49","https://downloads.isc.org/isc/bind9/9.20.23","https://downloads.isc.org/isc/bind9/9.21.22","https://kb.isc.org/docs/cve-2026-3592"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3592","description":"BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3592","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3592","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3592","cwe":"CWE-408","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3592","date":"2026-10-19","epss":0.00406,"percentile":0.33372}],"risk":0.20909000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3592","description":"A flaw was found in BIND resolvers. A remote attacker could exploit this vulnerability by sending a query to a specially crafted zone. This would cause the resolver to consume disproportionate resources, leading to a denial of service (DoS) due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-3592","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3592","cwe":"CWE-408","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3592","date":"2026-10-19","epss":0.00406,"percentile":0.33372}],"urls":["https://downloads.isc.org/isc/bind9/9.18.49","https://downloads.isc.org/isc/bind9/9.20.23","https://downloads.isc.org/isc/bind9/9.21.22","https://kb.isc.org/docs/cve-2026-3592"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3592","description":"BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84784","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84784","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-19","epss":0.00403,"percentile":0.33142}],"risk":0.207545,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84784","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting in excessive memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-84784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-19","epss":0.00403,"percentile":0.33142}],"urls":["https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a","https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806","https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f","https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"473fece84d4e5a84","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@23.3.2-11.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-pip-23.3.2-11.el10_2.src.rpm","type":"rpm","version":"23.3.2-11.el10_2","language":"","licenses":["MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"23.3.2-11.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50182","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-pip","version":"23.3.2-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-50182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50182","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50182","date":"2026-10-19","epss":0.00393,"percentile":0.32001}],"risk":0.202395,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-50182","description":"A flaw was found in urllib3. The library fails to properly validate redirect URLs, allowing an attacker to manipulate redirect chains when used in environments like Pyodide utilizing the JavaScript Fetch API. This lack of validation can enable a remote attacker to control the redirect destination, leading to arbitrary URL redirection. Consequently, an attacker can redirect users to malicious websites. This \nvulnerability stems from a failure to constrain the redirect target."},"relatedVulnerabilities":[{"id":"CVE-2025-50182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50182","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50182","date":"2026-10-19","epss":0.00393,"percentile":0.32001}],"urls":["https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-19","epss":0.00387,"percentile":0.3128}],"risk":0.199305,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75806","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by terminating an active Datagram Transport Layer Security (DTLS) session. By sending an undersized network packet that is shorter than the expected cryptographic overhead, the record processing layer fails to validate the packet length and misinterprets the packet as an internal error rather than an authentication failure. This improper handling triggers a fatal alert that unexpectedly closes the targeted connection without requiring valid encryption keys."},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-19","epss":0.00387,"percentile":0.3128}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-19","epss":0.00584,"percentile":0.46886}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-19","epss":0.00584,"percentile":0.46886}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-19","epss":0.00584,"percentile":0.46886}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-19","epss":0.00584,"percentile":0.46886}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-19","epss":0.00358,"percentile":0.28118}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-19","epss":0.00358,"percentile":0.28118}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-19","epss":0.00358,"percentile":0.28118}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-19","epss":0.00358,"percentile":0.28118}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-19","epss":0.00358,"percentile":0.28118}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-19","epss":0.00358,"percentile":0.28118}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-19","epss":0.00358,"percentile":0.28117}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-19","epss":0.00358,"percentile":0.28117}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-19","epss":0.00358,"percentile":0.28117}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-19","epss":0.00358,"percentile":0.28117}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-19","epss":0.00358,"percentile":0.28117}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-19","epss":0.00358,"percentile":0.28117}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-10148","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-10148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-19","epss":0.00499,"percentile":0.41513}],"risk":0.19460999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-10148","description":"A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server's malicious content and serves it to all users of that proxy."},"relatedVulnerabilities":[{"id":"CVE-2025-10148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-19","epss":0.00499,"percentile":0.41513}],"urls":["https://curl.se/docs/CVE-2025-10148.html","https://curl.se/docs/CVE-2025-10148.json","https://hackerone.com/reports/3330839","http://www.openwall.com/lists/oss-security/2025/09/10/2","http://www.openwall.com/lists/oss-security/2025/09/10/3","http://www.openwall.com/lists/oss-security/2025/09/10/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10148","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-10148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-19","epss":0.00499,"percentile":0.41513}],"risk":0.19460999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-10148","description":"A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server's malicious content and serves it to all users of that proxy."},"relatedVulnerabilities":[{"id":"CVE-2025-10148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10148","cwe":"CWE-340","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10148","date":"2026-10-19","epss":0.00499,"percentile":0.41513}],"urls":["https://curl.se/docs/CVE-2025-10148.html","https://curl.se/docs/CVE-2025-10148.json","https://hackerone.com/reports/3330839","http://www.openwall.com/lists/oss-security/2025/09/10/2","http://www.openwall.com/lists/oss-security/2025/09/10/3","http://www.openwall.com/lists/oss-security/2025/09/10/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-28835","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-28835","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28835","cwe":"CWE-248","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28835","date":"2026-10-19","epss":0.00389,"percentile":0.31527}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-28835","description":"A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the \"certtool --verify-chain\" command."},"relatedVulnerabilities":[{"id":"CVE-2024-28835","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28835","cwe":"CWE-248","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28835","date":"2026-10-19","epss":0.00389,"percentile":0.31527}],"urls":["https://access.redhat.com/errata/RHSA-2024:1879","https://access.redhat.com/errata/RHSA-2024:2570","https://access.redhat.com/errata/RHSA-2024:2889","https://access.redhat.com/security/cve/CVE-2024-28835","https://bugzilla.redhat.com/show_bug.cgi?id=2269084","https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html","http://www.openwall.com/lists/oss-security/2024/03/22/1","http://www.openwall.com/lists/oss-security/2024/03/22/2","https://lists.debian.org/debian-lts-announce/2024/09/msg00019.html","https://security.netapp.com/advisory/ntap-20241122-0009/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28835","description":"A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the \"certtool --verify-chain\" command."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1489","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-1489","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-10-19","epss":0.00371,"percentile":0.2962}],"risk":0.19292000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."},"relatedVulnerabilities":[{"id":"CVE-2026-1489","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-10-19","epss":0.00371,"percentile":0.2962}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1489","https://bugzilla.redhat.com/show_bug.cgi?id=2433348","https://gitlab.gnome.org/GNOME/glib/-/issues/3872","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1795","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1795","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-10-19","epss":0.00628,"percentile":0.49098}],"risk":0.19154000000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1795","description":"A flaw was found in Python. When a separating comma ends up on a folded line during an address list folding of email headers, the comma is unintentionally unicode encoded. The expected behavior is that the separating comma remains unencoded. This can result in the address header being misinterpreted by some mail servers."},"relatedVulnerabilities":[{"id":"CVE-2025-1795","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-10-19","epss":0.00628,"percentile":0.49098}],"urls":["https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48","https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593","https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74","https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d","https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090","https://github.com/python/cpython/issues/100884","https://github.com/python/cpython/pull/100885","https://github.com/python/cpython/pull/119099","https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1795","description":"During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1795","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1795","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-10-19","epss":0.00628,"percentile":0.49098}],"risk":0.19154000000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1795","description":"A flaw was found in Python. When a separating comma ends up on a folded line during an address list folding of email headers, the comma is unintentionally unicode encoded. The expected behavior is that the separating comma remains unencoded. This can result in the address header being misinterpreted by some mail servers."},"relatedVulnerabilities":[{"id":"CVE-2025-1795","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-10-19","epss":0.00628,"percentile":0.49098}],"urls":["https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48","https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593","https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74","https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d","https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090","https://github.com/python/cpython/issues/100884","https://github.com/python/cpython/pull/100885","https://github.com/python/cpython/pull/119099","https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1795","description":"During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-19","epss":0.00348,"percentile":0.26964}],"risk":0.18966000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102633","description":"A flaw was found in expat. On 32-bit systems, an integer overflow occurs within the expat_realloc memory allocation function when calculating buffer sizes. A remote attacker can exploit this vulnerability by supplying specially crafted XML input to an application that processes data with the library. Successful exploitation can lead to a Denial of Service (DoS) or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-19","epss":0.00348,"percentile":0.26964}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-29768","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-29768","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29768","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-29768","date":"2026-10-19","epss":0.00394,"percentile":0.32177}],"risk":0.18518,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-29768","description":"A flaw was found in Vim's zip.vim plugin. This vulnerability allows potential data loss via specially crafted zip files when a user views the archive in Vim and presses 'x' on an unusual filename."},"relatedVulnerabilities":[{"id":"CVE-2025-29768","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29768","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-29768","date":"2026-10-19","epss":0.00394,"percentile":0.32177}],"urls":["https://github.com/vim/vim/commit/f209dcd3defb95bae21b2740910e6aa7bb940531","https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf","https://security.netapp.com/advisory/ntap-20250502-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-29768","description":"Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-29768","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-29768","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29768","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-29768","date":"2026-10-19","epss":0.00394,"percentile":0.32177}],"risk":0.18518,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-29768","description":"A flaw was found in Vim's zip.vim plugin. This vulnerability allows potential data loss via specially crafted zip files when a user views the archive in Vim and presses 'x' on an unusual filename."},"relatedVulnerabilities":[{"id":"CVE-2025-29768","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-29768","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-29768","date":"2026-10-19","epss":0.00394,"percentile":0.32177}],"urls":["https://github.com/vim/vim/commit/f209dcd3defb95bae21b2740910e6aa7bb940531","https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf","https://security.netapp.com/advisory/ntap-20250502-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-29768","description":"Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-19","epss":0.00359,"percentile":0.28167}],"risk":0.184885,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-19","epss":0.00359,"percentile":0.28167}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-19","epss":0.00359,"percentile":0.28167}],"risk":0.184885,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-19","epss":0.00359,"percentile":0.28167}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-19","epss":0.0048,"percentile":0.40078}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-19","epss":0.0048,"percentile":0.40078}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-19","epss":0.0048,"percentile":0.40078}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-19","epss":0.0048,"percentile":0.40078}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"18a5b947a6d195a9","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-67897","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-67897","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-67897","cwe":"CWE-195","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-67897","date":"2026-10-19","epss":0.00354,"percentile":0.27671}],"risk":0.18231000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-67897","description":"A flaw was found in Sequoia. This vulnerability allows a remote attacker to crash an application via sending a victim an encrypted message with a crafted Public Key Encrypted Session Key (PKESK) or Symmetric Key Encrypted Session Key (SKESK) packet, which causes `aes_key_unwrap` to panic when processing a short ciphertext."},"relatedVulnerabilities":[{"id":"CVE-2025-67897","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-67897","cwe":"CWE-195","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-67897","date":"2026-10-19","epss":0.00354,"percentile":0.27671}],"urls":["https://bugs.debian.org/1122582","https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26","https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-67897","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-33056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-10-19","epss":0.00386,"percentile":0.31136}],"risk":0.18142000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-33056","description":"A flaw was found in tar-rs, a Rust library for reading and writing tar archives. When unpacking a crafted tar archive, an attacker can exploit a symbolic link vulnerability. By including a symlink followed by a directory with the same name, the library incorrectly applies file permissions to the symlink's target. This allows an attacker to modify the permissions of arbitrary directories outside the intended extraction location."},"relatedVulnerabilities":[{"id":"CVE-2026-33056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-10-19","epss":0.00386,"percentile":0.31136}],"urls":["https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446","https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75804","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-19","epss":0.00352,"percentile":0.2736}],"risk":0.18128,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75804","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can force the system to buffer far more data than permitted by the connection limit. This excessive memory allocation can exhaust available system resources and degrade or terminate the service."},"relatedVulnerabilities":[{"id":"CVE-2026-75804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-19","epss":0.00352,"percentile":0.2736}],"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"df4d86e2a1dfea76","cpes":["cpe:2.3:a:python3-requests:python3-requests:2.32.4-1.el10_0:*:*:*:*:*:*:*","cpe:2.3:a:python3-requests:python3_requests:2.32.4-1.el10_0:*:*:*:*:*:*:*","cpe:2.3:a:python3_requests:python3-requests:2.32.4-1.el10_0:*:*:*:*:*:*:*","cpe:2.3:a:python3_requests:python3_requests:2.32.4-1.el10_0:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-requests:2.32.4-1.el10_0:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_requests:2.32.4-1.el10_0:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-requests:2.32.4-1.el10_0:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_requests:2.32.4-1.el10_0:*:*:*:*:*:*:*"],"name":"python3-requests","purl":"pkg:rpm/redhat/python3-requests@2.32.4-1.el10_0?arch=noarch&distro=rhel-10.2&upstream=python-requests-2.32.4-1.el10_0.src.rpm","type":"rpm","version":"2.32.4-1.el10_0","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-requests","version":"2.32.4-1.el10_0"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35195","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-requests","version":"2.32.4-1.el10_0"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-35195","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.6,"impactScore":5.2,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35195","cwe":"CWE-670","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-35195","date":"2026-10-19","epss":0.0034,"percentile":0.25992}],"risk":0.1802,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-35195","description":"An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification."},"relatedVulnerabilities":[{"id":"CVE-2024-35195","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.6,"impactScore":5.2,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35195","cwe":"CWE-670","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-35195","date":"2026-10-19","epss":0.0034,"percentile":0.25992}],"urls":["https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac","https://github.com/psf/requests/pull/6655","https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195","description":"Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0989","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0989","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-10-19","epss":0.0053,"percentile":0.43651}],"risk":0.17754999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."},"relatedVulnerabilities":[{"id":"CVE-2026-0989","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-10-19","epss":0.0053,"percentile":0.43651}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0989","https://bugzilla.redhat.com/show_bug.cgi?id=2429933","https://gitlab.gnome.org/GNOME/libxml2/-/issues/998"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-3360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-3360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-10-19","epss":0.00528,"percentile":0.43543}],"risk":0.17687999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."},"relatedVulnerabilities":[{"id":"CVE-2025-3360","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-10-19","epss":0.00528,"percentile":0.43543}],"urls":["https://access.redhat.com/security/cve/CVE-2025-3360","https://bugzilla.redhat.com/show_bug.cgi?id=2357754","https://gitlab.gnome.org/GNOME/glib/-/issues/3647","https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://gitlab.gnome.org/GNOME/glib/-/work_items/3647"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","metrics":{"baseScore":6.8,"impactScore":5.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-19","epss":0.00297,"percentile":0.21023}],"risk":0.17522999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19499","description":"A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-19","epss":0.00297,"percentile":0.21023}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","metrics":{"baseScore":6.8,"impactScore":5.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-19","epss":0.00297,"percentile":0.21023}],"risk":0.17522999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19499","description":"A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-19","epss":0.00297,"percentile":0.21023}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","metrics":{"baseScore":6.8,"impactScore":5.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-19","epss":0.00297,"percentile":0.21023}],"risk":0.17522999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19499","description":"A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-19","epss":0.00297,"percentile":0.21023}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-6052","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-6052","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6052","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6052","date":"2026-10-19","epss":0.00522,"percentile":0.43077}],"risk":0.17486999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-6052","description":"A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2025-6052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6052","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6052","date":"2026-10-19","epss":0.00522,"percentile":0.43077}],"urls":["https://access.redhat.com/security/cve/CVE-2025-6052","https://bugzilla.redhat.com/show_bug.cgi?id=2372666","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://openjdk.org/groups/vulnerability/advisories/2026-01-20","https://www.oracle.com/security-alerts/cpuapr2026.html","https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6052","description":"A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption."}]},{"artifact":{"id":"286b8a6d4a84d372","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.3.5-1.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtirpc:1.3.5-1.el10:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:rpm/redhat/libtirpc@1.3.5-1.el10?arch=x86_64&distro=rhel-10.2&upstream=libtirpc-1.3.5-1.el10.src.rpm","type":"rpm","version":"1.3.5-1.el10","language":"","licenses":["SISSL AND BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libtirpc","version":"0:1.3.5-1.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-10-19","epss":0.00297,"percentile":0.21017}],"risk":0.17077499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-10-19","epss":0.00297,"percentile":0.21017}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42772","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-19","epss":0.0033,"percentile":0.24601}],"risk":0.16995000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42772","description":"A flaw was found in OpenSSL. A remote attacker who establishes a QUIC network connection can cause a Denial of Service (DoS) by sending specially sequenced, out-of-order stream frames. Because the stream reassembly mechanism handles non-sequential data fragments inefficiently, processing these frames forces the server to consume excessive CPU resources. Consequently, an attacker can exhaust system processing capacity using minimal network bandwidth."},"relatedVulnerabilities":[{"id":"CVE-2026-42772","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-19","epss":0.0033,"percentile":0.24601}],"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3591","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3591","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3591","cwe":"CWE-305","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-3591","cwe":"CWE-562","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3591","date":"2026-10-19","epss":0.00324,"percentile":0.24031}],"risk":0.16848,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3591","description":"A flaw was found in BIND, specifically in the named server's handling of DNS queries signed with SIG(0). A remote attacker could exploit this use-after-return vulnerability by sending a specially-crafted DNS request. This could cause an Access Control List (ACL) to improperly match an IP address, potentially leading to unauthorized access to resources."},"relatedVulnerabilities":[{"id":"CVE-2026-3591","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3591","cwe":"CWE-305","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-3591","cwe":"CWE-562","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3591","date":"2026-10-19","epss":0.00324,"percentile":0.24031}],"urls":["https://downloads.isc.org/isc/bind9/9.20.21","https://downloads.isc.org/isc/bind9/9.21.20","https://kb.isc.org/docs/cve-2026-3591"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3591","description":"A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3591","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3591","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3591","cwe":"CWE-305","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-3591","cwe":"CWE-562","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3591","date":"2026-10-19","epss":0.00324,"percentile":0.24031}],"risk":0.16848,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3591","description":"A flaw was found in BIND, specifically in the named server's handling of DNS queries signed with SIG(0). A remote attacker could exploit this use-after-return vulnerability by sending a specially-crafted DNS request. This could cause an Access Control List (ACL) to improperly match an IP address, potentially leading to unauthorized access to resources."},"relatedVulnerabilities":[{"id":"CVE-2026-3591","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3591","cwe":"CWE-305","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-3591","cwe":"CWE-562","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3591","date":"2026-10-19","epss":0.00324,"percentile":0.24031}],"urls":["https://downloads.isc.org/isc/bind9/9.20.21","https://downloads.isc.org/isc/bind9/9.21.20","https://kb.isc.org/docs/cve-2026-3591"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3591","description":"A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3591","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3591","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3591","cwe":"CWE-305","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-3591","cwe":"CWE-562","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3591","date":"2026-10-19","epss":0.00324,"percentile":0.24031}],"risk":0.16848,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3591","description":"A flaw was found in BIND, specifically in the named server's handling of DNS queries signed with SIG(0). A remote attacker could exploit this use-after-return vulnerability by sending a specially-crafted DNS request. This could cause an Access Control List (ACL) to improperly match an IP address, potentially leading to unauthorized access to resources."},"relatedVulnerabilities":[{"id":"CVE-2026-3591","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3591","cwe":"CWE-305","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-3591","cwe":"CWE-562","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-3591","date":"2026-10-19","epss":0.00324,"percentile":0.24031}],"urls":["https://downloads.isc.org/isc/bind9/9.20.21","https://downloads.isc.org/isc/bind9/9.21.20","https://kb.isc.org/docs/cve-2026-3591"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3591","description":"A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-43961","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-43961","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43961","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-43961","date":"2026-10-19","epss":0.0022,"percentile":0.11763}],"risk":0.1683,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-43961","description":"A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim."},"relatedVulnerabilities":[{"id":"CVE-2026-43961","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43961","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-43961","date":"2026-10-19","epss":0.0022,"percentile":0.11763}],"urls":["https://access.redhat.com/errata/RHSA-2026:57614","https://access.redhat.com/security/cve/CVE-2026-43961","https://bugzilla.redhat.com/show_bug.cgi?id=2460434","https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3","http://www.openwall.com/lists/oss-security/2026/05/14/7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43961","description":"A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-43961","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-43961","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43961","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-43961","date":"2026-10-19","epss":0.0022,"percentile":0.11763}],"risk":0.1683,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-43961","description":"A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim."},"relatedVulnerabilities":[{"id":"CVE-2026-43961","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43961","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-43961","date":"2026-10-19","epss":0.0022,"percentile":0.11763}],"urls":["https://access.redhat.com/errata/RHSA-2026:57614","https://access.redhat.com/security/cve/CVE-2026-43961","https://bugzilla.redhat.com/show_bug.cgi?id=2460434","https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3","http://www.openwall.com/lists/oss-security/2026/05/14/7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43961","description":"A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"risk":0.16524,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76642","description":"When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-19","epss":0.00216,"percentile":0.11276}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69650","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69650","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69650","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-69650","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69650","date":"2026-10-19","epss":0.00522,"percentile":0.43101}],"risk":0.16442999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69650","description":"A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed relocation data with the readelf program can trigger a double free, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-69650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69650","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-69650","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69650","date":"2026-10-19","epss":0.00522,"percentile":0.43101}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33698","https://sourceware.org/bugzilla/show_bug.cgi?id=33700","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=81e90cf63a10ad11772c2437c8f2a88f1a00c739","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=ea4bc025abdba85a90e26e13f551c16a44bfa92","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69650","description":"GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-19","epss":0.00214,"percentile":0.11102}],"risk":0.16157000000000002,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103111","description":"A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-19","epss":0.00214,"percentile":0.11102}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-19","epss":0.00214,"percentile":0.11102}],"risk":0.16157000000000002,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103111","description":"A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-19","epss":0.00214,"percentile":0.11102}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-19","epss":0.00479,"percentile":0.40017}],"risk":0.16046499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13608","description":"A flaw was found in libcurl's SASL (Simple Authentication and Security Layer) negotiation for LDAP (Lightweight Directory Access Protocol) authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack, could inject a premature response to bypass complete peer validation, leading to an authentication bypass."},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-19","epss":0.00479,"percentile":0.40017}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-19","epss":0.00479,"percentile":0.40017}],"risk":0.16046499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13608","description":"A flaw was found in libcurl's SASL (Simple Authentication and Security Layer) negotiation for LDAP (Lightweight Directory Access Protocol) authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack, could inject a premature response to bypass complete peer validation, leading to an authentication bypass."},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-19","epss":0.00479,"percentile":0.40017}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1484","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-1484","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-10-19","epss":0.00346,"percentile":0.26746}],"risk":0.15916,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."},"relatedVulnerabilities":[{"id":"CVE-2026-1484","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-10-19","epss":0.00346,"percentile":0.26746}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1484","https://bugzilla.redhat.com/show_bug.cgi?id=2433259","https://gitlab.gnome.org/GNOME/glib/-/issues/3870","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."}]},{"artifact":{"id":"473fece84d4e5a84","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@23.3.2-11.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-pip-23.3.2-11.el10_2.src.rpm","type":"rpm","version":"23.3.2-11.el10_2","language":"","licenses":["MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"23.3.2-11.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13346","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-pip","version":"23.3.2-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13346","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":5.9,"impactScore":4.8,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13346","cwe":"CWE-36","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-13346","date":"2026-10-19","epss":0.00292,"percentile":0.2047}],"risk":0.15914,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13346","description":"A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option."},"relatedVulnerabilities":[{"id":"CVE-2026-13346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13346","cwe":"CWE-36","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-13346","date":"2026-10-19","epss":0.00292,"percentile":0.2047}],"urls":["https://github.com/pypa/pip/pull/14110","https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/","http://www.openwall.com/lists/oss-security/2026/07/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13346","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88647","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-88647","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-10-19","epss":0.00212,"percentile":0.10816}],"risk":0.15794,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-88647","description":"A flaw was found in GnuTLS. This vulnerability can lead to information disclosure by allowing an attacker to bypass certificate hostname verification. A remote attacker presenting a crafted certificate can circumvent the Common Name fallback check, enabling them to eavesdrop on or intercept encrypted network communications."},"relatedVulnerabilities":[{"id":"CVE-2026-88647","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-10-19","epss":0.00212,"percentile":0.10816}],"urls":["https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642","https://gitlab.com/gnutls/gnutls/-/issues/1802"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","description":"A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1215","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1215","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1215","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1215","date":"2026-10-19","epss":0.00541,"percentile":0.44386}],"risk":0.15688999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1215","description":"A flaw was found in Vim. A local user may be able to trigger memory corruption by using the `--log` option with a non-existent path, which can lead to an application crash or other undefined behavior."},"relatedVulnerabilities":[{"id":"CVE-2025-1215","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1215","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1215","date":"2026-10-19","epss":0.00541,"percentile":0.44386}],"urls":["https://github.com/vim/vim/commit/c5654b84480822817bb7b69ebc97c174c91185e9","https://github.com/vim/vim/issues/16606","https://github.com/vim/vim/releases/tag/v9.1.1097","https://vuldb.com/?ctiid.295174","https://vuldb.com/?id.295174","https://vuldb.com/?submit.497546","https://security.netapp.com/advisory/ntap-20250321-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1215","description":"A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1215","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1215","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1215","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1215","date":"2026-10-19","epss":0.00541,"percentile":0.44386}],"risk":0.15688999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1215","description":"A flaw was found in Vim. A local user may be able to trigger memory corruption by using the `--log` option with a non-existent path, which can lead to an application crash or other undefined behavior."},"relatedVulnerabilities":[{"id":"CVE-2025-1215","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1215","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1215","date":"2026-10-19","epss":0.00541,"percentile":0.44386}],"urls":["https://github.com/vim/vim/commit/c5654b84480822817bb7b69ebc97c174c91185e9","https://github.com/vim/vim/issues/16606","https://github.com/vim/vim/releases/tag/v9.1.1097","https://vuldb.com/?ctiid.295174","https://vuldb.com/?id.295174","https://vuldb.com/?submit.497546","https://security.netapp.com/advisory/ntap-20250321-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1215","description":"A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"0214d467056f818c","cpes":["cpe:2.3:a:python3-urllib3:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-urllib3:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_urllib3:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_urllib3:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_urllib3:1.26.19-4.el10_2:*:*:*:*:*:*:*"],"name":"python3-urllib3","purl":"pkg:rpm/redhat/python3-urllib3@1.26.19-4.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-urllib3-1.26.19-4.el10_2.src.rpm","type":"rpm","version":"1.26.19-4.el10_2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-urllib3","version":"1.26.19-4.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97687","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-urllib3","version":"1.26.19-4.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97687","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97687","cwe":"CWE-440","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97687","date":"2026-10-19","epss":0.00206,"percentile":0.10018}],"risk":0.15347000000000002,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97687","description":"A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-97687","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97687","cwe":"CWE-440","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97687","date":"2026-10-19","epss":0.00206,"percentile":0.10018}],"urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"18903e2417661546","cpes":["cpe:2.3:a:libgcc:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"risk":0.15,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"26b8f4fefa0b3ec4","cpes":["cpe:2.3:a:libgomp:libgomp:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgomp:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libgomp","purl":"pkg:rpm/redhat/libgomp@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"risk":0.15,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"7e1663f3df86ee06","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:14.3.1-4.4.el10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@14.3.1-4.4.el10?arch=x86_64&distro=rhel-10.2&upstream=gcc-14.3.1-4.4.el10.src.rpm","type":"rpm","version":"14.3.1-4.4.el10","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1) AND (GPL-3.0-or-later WITH Texinfo-exception) AND (LGPL-2.1-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH GNU-compiler-exception) AND BSL-1.0 AND GFDL-1.3-or-later AND Linux-man-pages-copyleft-2-para AND SunPro AND BSD-1-Clause AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND BSD-4-Clause AND BSD-Source-Code AND Zlib AND MIT AND Apache-2.0 AND (Apache-2.0 WITH LLVM-Exception) AND ZPL-2.1 AND ISC AND LicenseRef-Fedora-Public-Domain AND HP-1986 AND curl AND Martin-Birgmeier AND HPND-Markus-Kuhn AND dtoa AND SMLNJ AND AMD-newlib AND OAR AND HPND-merchantability-variant AND HPND-Intel"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"14.3.1-4.4.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gcc","version":"14.3.1-4.4.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"risk":0.15,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-19","epss":0.0025,"percentile":0.15266}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"risk":0.14873,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89157","description":"A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"risk":0.14873,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89157","description":"A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0988","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0988","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-10-19","epss":0.00434,"percentile":0.36352}],"risk":0.14539,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-0988","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-10-19","epss":0.00434,"percentile":0.36352}],"urls":["https://access.redhat.com/errata/RHSA-2026:7461","https://access.redhat.com/security/cve/CVE-2026-0988","https://bugzilla.redhat.com/show_bug.cgi?id=2429886","https://gitlab.gnome.org/GNOME/glib/-/issues/3851"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-72897","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.14497000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-72897","description":"A flaw was found in openssl. When a server replaces its security context during an active Transport Layer Security (TLS) handshake, it fails to update the internal capacity tracking for cryptographic signature algorithms. A remote peer can exploit this issue by advertising specific signature algorithms, causing out-of-bounds memory reads and writes on the server heap. This vulnerability can corrupt internal memory and terminate the process, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-72897","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"286b8a6d4a84d372","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.3.5-1.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtirpc:1.3.5-1.el10:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:rpm/redhat/libtirpc@1.3.5-1.el10?arch=x86_64&distro=rhel-10.2&upstream=libtirpc-1.3.5-1.el10.src.rpm","type":"rpm","version":"1.3.5-1.el10","language":"","licenses":["SISSL AND BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libtirpc","version":"0:1.3.5-1.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-10-19","epss":0.0028,"percentile":0.19248}],"risk":0.1442,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-10-19","epss":0.0028,"percentile":0.19248}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54872","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-19","epss":0.00263,"percentile":0.16964}],"risk":0.14333500000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54872","description":"A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm (ECDSA) or SM2, using curves without dedicated constant-time implementations, variations in processing time leak information about the per-signature secret value. By measuring the duration of numerous signing operations, an attacker can analyze these timing differences to reconstruct the private signing key."},"relatedVulnerabilities":[{"id":"CVE-2026-54872","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-19","epss":0.00263,"percentile":0.16964}],"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-19","epss":0.00186,"percentile":0.07752}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54875","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-54875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54875","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54875","date":"2026-10-19","epss":0.00294,"percentile":0.20657}],"risk":0.14259,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54875","description":"A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side channel during decryption or digital signature generation. This vulnerability allows the attacker to deduce sensitive private keys or signature nonces, leading to information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-54875","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54875","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54875","date":"2026-10-19","epss":0.00294,"percentile":0.20657}],"urls":["https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54875","description":"Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov"}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-19","epss":0.00247,"percentile":0.14944}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89158","description":"A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-19","epss":0.00247,"percentile":0.14944}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-19","epss":0.00247,"percentile":0.14944}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89158","description":"A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-19","epss":0.00247,"percentile":0.14944}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-19","epss":0.00239,"percentile":0.13982}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-19","epss":0.00239,"percentile":0.13982}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-19","epss":0.00239,"percentile":0.13982}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-10-19","epss":0.00239,"percentile":0.13982}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7458","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-7458","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7458","cwe":"CWE-190","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-7458","date":"2026-10-19","epss":0.00252,"percentile":0.15599}],"risk":0.13985999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-7458","description":"An integer overflow flaw has been discovered in SQLite. This flaw allows an attacker who has the ability to execute raw SQL statements to induce a denial of service or leak process memory."},"relatedVulnerabilities":[{"id":"CVE-2025-7458","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7458","cwe":"CWE-190","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-7458","date":"2026-10-19","epss":0.00252,"percentile":0.15599}],"urls":["https://sqlite.org/forum/forumpost/16ce2bb7a639e29b","https://sqlite.org/src/info/12ad822d9b827777"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7458","description":"An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-7039","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-7039","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-10-19","epss":0.00417,"percentile":0.34565}],"risk":0.13969499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."},"relatedVulnerabilities":[{"id":"CVE-2025-7039","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-10-19","epss":0.00417,"percentile":0.34565}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7039","https://bugzilla.redhat.com/show_bug.cgi?id=2392423","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19033","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19033","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-19","epss":0.0024,"percentile":0.14208}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19033","description":"A flaw was found in bind. A remote attacker without a valid TSIG (Transaction Signature) can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR (Incremental Zone Transfer). The `named` process may apply this unauthenticated data before the TSIG signature is verified. If the signature never arrives, `named` does not revert to its previous state, leading to the serving of unauthorized zone data and compromising information integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-19033","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-19","epss":0.0024,"percentile":0.14208}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19033"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19033","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19033","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19033","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-19","epss":0.0024,"percentile":0.14208}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19033","description":"A flaw was found in bind. A remote attacker without a valid TSIG (Transaction Signature) can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR (Incremental Zone Transfer). The `named` process may apply this unauthenticated data before the TSIG signature is verified. If the signature never arrives, `named` does not revert to its previous state, leading to the serving of unauthorized zone data and compromising information integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-19033","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-19","epss":0.0024,"percentile":0.14208}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19033"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19033","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19033","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19033","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-19","epss":0.0024,"percentile":0.14208}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19033","description":"A flaw was found in bind. A remote attacker without a valid TSIG (Transaction Signature) can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR (Incremental Zone Transfer). The `named` process may apply this unauthenticated data before the TSIG signature is verified. If the signature never arrives, `named` does not revert to its previous state, leading to the serving of unauthorized zone data and compromising information integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-19033","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-19","epss":0.0024,"percentile":0.14208}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19033"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19033","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-10-19","epss":0.00178,"percentile":0.06895}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41957","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-41957","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41957","date":"2026-10-19","epss":0.00366,"percentile":0.28996}],"risk":0.13725,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41957","description":"A double-free and use-after-free vulnerability was found in the Vim editor. This flaw exists due to the corresponding tagstack being used twice when closing the window and if the quick fix list belonging to that window is also cleared using the same tagstack data. In this instance, Vim will try to free the memory again, causing a crash."},"relatedVulnerabilities":[{"id":"CVE-2024-41957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41957","date":"2026-10-19","epss":0.00366,"percentile":0.28996}],"urls":["https://github.com/vim/vim/commit/8a0bbe7b8aad6f8da28dee218c01bc8a0185a","https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4","http://seclists.org/fulldisclosure/2024/Sep/33","http://www.openwall.com/lists/oss-security/2024/08/01/1","https://security.netapp.com/advisory/ntap-20241129-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41957","description":"Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags,\nbut it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647"}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41957","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-41957","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41957","date":"2026-10-19","epss":0.00366,"percentile":0.28996}],"risk":0.13725,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41957","description":"A double-free and use-after-free vulnerability was found in the Vim editor. This flaw exists due to the corresponding tagstack being used twice when closing the window and if the quick fix list belonging to that window is also cleared using the same tagstack data. In this instance, Vim will try to free the memory again, causing a crash."},"relatedVulnerabilities":[{"id":"CVE-2024-41957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41957","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41957","date":"2026-10-19","epss":0.00366,"percentile":0.28996}],"urls":["https://github.com/vim/vim/commit/8a0bbe7b8aad6f8da28dee218c01bc8a0185a","https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4","http://seclists.org/fulldisclosure/2024/Sep/33","http://www.openwall.com/lists/oss-security/2024/08/01/1","https://security.netapp.com/advisory/ntap-20241129-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41957","description":"Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags,\nbut it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647"}]},{"artifact":{"id":"e8e4e4186e95c503","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.21.3-10.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.21.3-10.el10_2:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.21.3-10.el10_2?arch=x86_64&distro=rhel-10.2&upstream=krb5-1.21.3-10.el10_2.src.rpm","type":"rpm","version":"1.21.3-10.el10_2","language":"","licenses":["Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.21.3-10.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11850","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"krb5","version":"1.21.3-10.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-11850","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-10-19","epss":0.00271,"percentile":0.18133}],"risk":0.1355,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."},"relatedVulnerabilities":[{"id":"CVE-2026-11850","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-10-19","epss":0.00271,"percentile":0.18133}],"urls":["https://access.redhat.com/errata/RHSA-2026:25520","https://access.redhat.com/security/cve/CVE-2026-11850","https://bugzilla.redhat.com/show_bug.cgi?id=2459970"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0992","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0992","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-10-19","epss":0.00459,"percentile":0.38413}],"risk":0.135405,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2026-0992","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-10-19","epss":0.00459,"percentile":0.38413}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0992","https://bugzilla.redhat.com/show_bug.cgi?id=2429975","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22134","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-22134","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22134","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-22134","date":"2026-10-19","epss":0.00374,"percentile":0.29907}],"risk":0.13464,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-22134","description":"A flaw was found in Vim. Due to Vim not properly terminating visual mode, a heap buffer overflow condition may be triggered when a user switches buffers using the `:all` command. This issue may lead to unexpected behavior, such as an application crash or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2025-22134","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22134","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-22134","date":"2026-10-19","epss":0.00374,"percentile":0.29907}],"urls":["https://github.com/vim/vim/commit/c9a1e257f1630a0866447e53a564f7ff96a80ead","https://github.com/vim/vim/security/advisories/GHSA-5rgf-26wj-48v8","http://www.openwall.com/lists/oss-security/2025/01/11/1","https://security.netapp.com/advisory/ntap-20250314-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22134","description":"When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003"}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22134","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-22134","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22134","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-22134","date":"2026-10-19","epss":0.00374,"percentile":0.29907}],"risk":0.13464,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-22134","description":"A flaw was found in Vim. Due to Vim not properly terminating visual mode, a heap buffer overflow condition may be triggered when a user switches buffers using the `:all` command. This issue may lead to unexpected behavior, such as an application crash or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2025-22134","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22134","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-22134","date":"2026-10-19","epss":0.00374,"percentile":0.29907}],"urls":["https://github.com/vim/vim/commit/c9a1e257f1630a0866447e53a564f7ff96a80ead","https://github.com/vim/vim/security/advisories/GHSA-5rgf-26wj-48v8","http://www.openwall.com/lists/oss-security/2025/01/11/1","https://security.netapp.com/advisory/ntap-20250314-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22134","description":"When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003"}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-41080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-10-19","epss":0.00398,"percentile":0.32563}],"risk":0.13333,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41080","description":"A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing a specially crafted XML document that leverages insufficient entropy in the hash function. This can lead to hash flooding, a type of Denial of Service (DoS) attack, where the system becomes unresponsive or crashes due to excessive resource consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-41080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-10-19","epss":0.00398,"percentile":0.32563}],"urls":["https://blog.hartwork.org/posts/expat-2-8-0-released/","https://github.com/libexpat/libexpat/issues/47","https://github.com/libexpat/libexpat/pull/1183","https://www.openwall.com/lists/oss-security/2026/04/26/1","http://www.openwall.com/lists/oss-security/2026/04/26/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41080","description":"libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77696","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-19","epss":0.00243,"percentile":0.14551}],"risk":0.132435,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77696","description":"A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, which may allow them to recover the private key."},"relatedVulnerabilities":[{"id":"CVE-2026-77696","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-19","epss":0.00243,"percentile":0.14551}],"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5918","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-10-19","epss":0.00377,"percentile":0.30194}],"risk":0.130065,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2025-5918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-10-19","epss":0.00377,"percentile":0.30194}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5918","https://bugzilla.redhat.com/show_bug.cgi?id=2370877","https://github.com/libarchive/libarchive/pull/2584","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5245","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5245","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5245","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-5245","date":"2026-10-19","epss":0.00286,"percentile":0.19811}],"risk":0.1287,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5245","description":"A denial-of-service vulnerability has been identified in GNU Binutils, affecting versions up to 2.44. The flaw resides within the debug_type_samep function in the /binutils/debug.c file of the objdump component. An attacker with local access can trigger a program crash by manipulating input data, leading to a denial of service for the objdump utility."},"relatedVulnerabilities":[{"id":"CVE-2025-5245","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4.3,"impactScore":6.5,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5245","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-5245","date":"2026-10-19","epss":0.00286,"percentile":0.19811}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16004","https://sourceware.org/bugzilla/show_bug.cgi?id=32829","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a","https://vuldb.com/?ctiid.310347","https://vuldb.com/?id.310347","https://vuldb.com/?submit.584635","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5245","description":"A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5244","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5244","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5244","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-5244","date":"2026-10-19","epss":0.00284,"percentile":0.19646}],"risk":0.1278,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5244","description":"A vulnerability was found in GNU Binutils 2.40 to version 2.44 and affects the elf_gc_sweep function of the bfd/elflink.c file of the component ld. The manipulation leads to memory corruption and a program crash. An attacker must have local access to exploit this vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2025-5244","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4.3,"impactScore":6.5,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5244","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-5244","date":"2026-10-19","epss":0.00284,"percentile":0.19646}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16010","https://sourceware.org/bugzilla/show_bug.cgi?id=32858","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d1458933830456e54223d9fc61f0d9b3a19256f5","https://vuldb.com/?ctiid.310346","https://vuldb.com/?id.310346","https://vuldb.com/?submit.584634","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5244","description":"A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6019","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6019","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-10-19","epss":0.00211,"percentile":0.10695}],"risk":0.12448999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6019","description":"A flaw was found in Python's `http.cookies` module. The `Morsel.js_output()` function, responsible for generating JavaScript output for cookies, does not properly neutralize the `</script>` HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to Cross-Site Scripting (XSS) attacks. Such an attack could result in information disclosure or arbitrary code execution within the user's browser."},"relatedVulnerabilities":[{"id":"CVE-2026-6019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-10-19","epss":0.00211,"percentile":0.10695}],"urls":["https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c","https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104","https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8","https://github.com/python/cpython/issues/90309","https://github.com/python/cpython/pull/148848","https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6019","description":"http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6019","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6019","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-10-19","epss":0.00211,"percentile":0.10695}],"risk":0.12448999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6019","description":"A flaw was found in Python's `http.cookies` module. The `Morsel.js_output()` function, responsible for generating JavaScript output for cookies, does not properly neutralize the `</script>` HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to Cross-Site Scripting (XSS) attacks. Such an attack could result in information disclosure or arbitrary code execution within the user's browser."},"relatedVulnerabilities":[{"id":"CVE-2026-6019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-10-19","epss":0.00211,"percentile":0.10695}],"urls":["https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c","https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104","https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8","https://github.com/python/cpython/issues/90309","https://github.com/python/cpython/pull/148848","https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6019","description":"http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-19","epss":0.00371,"percentile":0.29619}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-19","epss":0.00371,"percentile":0.29619}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-19","epss":0.00371,"percentile":0.29619}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-19","epss":0.00371,"percentile":0.29619}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"ef3a16f545e37aec","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.12.5-10.el10_2.4:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.12.5-10.el10_2.4?arch=x86_64&distro=rhel-10.2&upstream=libxml2-2.12.5-10.el10_2.4.src.rpm","type":"rpm","version":"2.12.5-10.el10_2.4","language":"","licenses":["MIT AND ISC-Veillard AND W3C"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1757","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libxml2","version":"0:2.12.5-10.el10_2.4"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-1757","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-10-19","epss":0.00221,"percentile":0.11833}],"risk":0.12376000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."},"relatedVulnerabilities":[{"id":"CVE-2026-1757","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-10-19","epss":0.00221,"percentile":0.11833}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-1757","https://bugzilla.redhat.com/show_bug.cgi?id=2435940","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77119","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77119","cwe":"CWE-346","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-77119","date":"2026-10-19","epss":0.00226,"percentile":0.12499}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77119","description":"A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver, potentially leading to DNS spoofing or integrity compromise."},"relatedVulnerabilities":[{"id":"CVE-2026-77119","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77119","cwe":"CWE-346","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-77119","date":"2026-10-19","epss":0.00226,"percentile":0.12499}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-77119"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77119","description":"A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77119","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77119","cwe":"CWE-346","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-77119","date":"2026-10-19","epss":0.00226,"percentile":0.12499}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77119","description":"A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver, potentially leading to DNS spoofing or integrity compromise."},"relatedVulnerabilities":[{"id":"CVE-2026-77119","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77119","cwe":"CWE-346","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-77119","date":"2026-10-19","epss":0.00226,"percentile":0.12499}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-77119"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77119","description":"A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77119","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-77119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77119","cwe":"CWE-346","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-77119","date":"2026-10-19","epss":0.00226,"percentile":0.12499}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77119","description":"A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver, potentially leading to DNS spoofing or integrity compromise."},"relatedVulnerabilities":[{"id":"CVE-2026-77119","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77119","cwe":"CWE-346","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-77119","date":"2026-10-19","epss":0.00226,"percentile":0.12499}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-77119"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77119","description":"A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19941","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19941","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-19","epss":0.00226,"percentile":0.12498}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19941","description":"A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC (Next Secure) record to a `named` resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS (Domain Name System) record, potentially leading to a misrepresentation of DNS information."},"relatedVulnerabilities":[{"id":"CVE-2026-19941","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-19","epss":0.00226,"percentile":0.12498}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19941"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19941","description":"An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19941","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19941","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-19","epss":0.00226,"percentile":0.12498}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19941","description":"A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC (Next Secure) record to a `named` resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS (Domain Name System) record, potentially leading to a misrepresentation of DNS information."},"relatedVulnerabilities":[{"id":"CVE-2026-19941","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-19","epss":0.00226,"percentile":0.12498}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19941"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19941","description":"An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19941","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19941","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-19","epss":0.00226,"percentile":0.12498}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19941","description":"A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC (Next Secure) record to a `named` resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS (Domain Name System) record, potentially leading to a misrepresentation of DNS information."},"relatedVulnerabilities":[{"id":"CVE-2026-19941","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-19","epss":0.00226,"percentile":0.12498}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19941"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19941","description":"An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84783","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84783","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-10-19","epss":0.00226,"percentile":0.12442}],"risk":0.12317,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84783","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-84783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-10-19","epss":0.00226,"percentile":0.12442}],"urls":["https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84783","description":"Issue summary: The first concurrent use of the same X.509 certificate by\nseveral threads may cause its cached extension data to be freed while\nanother thread is still using it.\n\nImpact summary: A remote, unauthenticated peer could crash a multi-threaded\nTLS client, or a multi-threaded TLS server that requests client\ncertificates, if the first certificate chains built to the same trusted CA\ncertificate are built by several connections at the same time. This is a\nuse-after-free read, which is likely to crash the process, resulting in a\nDenial of Service.\n\nCWE: CWE-416: Use After Free\n\nDescription: OpenSSL caches the decoded values of a certificate's X.509v3\nextensions inside the X509 object the first time they are needed. In\nOpenSSL 4.0 this cache is built in two phases: the extension values are\ncomputed while holding a read lock on the certificate, and the results are\nthen installed into the certificate under a write lock. Because a read lock\ndoes not exclude other readers, several threads can compute the cache for\nthe same certificate at the same time. Each thread that subsequently\nacquires the write lock installs its own results and frees the values\ninstalled by the thread before it, even though that earlier thread has\nalready marked the cache as complete and may have returned pointers into it\nto its caller. A caller still using those pointers then reads freed memory.\n\nAny certificate shared between threads is exposed the first time its\nextensions are decoded. In TLS the certificates at risk are the trusted CA\ncertificates supplied for chain verification, by whatever means, since these\nare shared by every connection and their extensions are decoded and cached\nthe first time a chain is built to them. Certificates sent by the peer are\ndecoded separately for each connection and are not shared, so they are not\naffected. In a TLS client verifying server certificates, or a TLS server\nthat requests and verifies client certificates, the use-after-free could\nonly occur if the first chains built to the same trusted CA are built by\nseveral connections at the same time.\n\nFIPS impact: no\nThe FIPS module is not affected as X.509 certificate handling is outside\nof the OpenSSL FIPS module boundary.\n\nOpenSSL 4.0 is vulnerable to this issue.\n\nOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\n\nThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\nindependently in a public report on 31 August 2026 by aydinmercan.\n\nThe fix has been developed by Bob Beck.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Tim Becker (Xint.io), aydinmercan\nFixed by: Bob Beck"}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75805","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75805","date":"2026-10-19","epss":0.00222,"percentile":0.11962}],"risk":0.12099000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75805","description":"A flaw was found in OpenSSL. When a Certificate Management Protocol (CMP) client requests certificate revocation using a PKCS#10 Certificate Signing Request (CSR), it omits the certificate issuer name and serial number. A malicious or compromised CMP server, or an attacker possessing valid message protection credentials, can exploit this flaw by returning a crafted revocation response. This triggers a NULL pointer dereference when the client attempts to compare response data, causing the client application to crash and resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-75805","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75805","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75805","date":"2026-10-19","epss":0.00222,"percentile":0.11962}],"urls":["https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166","https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7","https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3","https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75805","description":"Issue summary: A CMP client that requests certificate revocation on the basis\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when\nprocessing a crafted revocation response. \n\nImpact summary: The NULL pointer dereference happens on a read which \nleads to a crash and a Denial of Service for the affected client application.\n\nCWE: CWE-476: NULL-pointer dereference\n\nDescription: A CMP client revoking a certificate has to tell the server which\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the\ncertificate itself or its issuer name and serial number. This is\n'openssl cmp -cmd rr -csr <file>' on the command line, or\nOSSL_CMP_exec_RR_ses() with the certificate supplied via\nOSSL_CMP_CTX_set1_p10CSR() through the API.\n\nA CSR does not contain the issuer name and serial number of the certificate,\nso the client does not send them. A server may optionally name the\ncertificate it revoked in its response, and the client then compares that\nname against what it sent. Having sent neither an issuer name nor a serial\nnumber, it has nothing to compare against, and a server returning a specially\ncrafted name causes the client to read from a NULL pointer and crash.\n\nThe revocation response is checked for valid message protection before\nthe affected code is reached, so an attacker must be a malicious or\ncompromised CMP server, or a man-in-the-middle in possession of the\nsecret used for message protection. Clients that identify the certificate\nto be revoked by a certificate or by issuer and serial number rather\nthan by a PKCS#10 CSR are not affected.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-19","epss":0.0022,"percentile":0.11673}],"risk":0.11990000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6791","description":"A flaw was found in glibc. When processing paths that start with a tilde (~) followed by a username, the `wordexp` function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhaustion and causing a denial of service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-19","epss":0.0022,"percentile":0.11673}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-19","epss":0.0022,"percentile":0.11673}],"risk":0.11990000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6791","description":"A flaw was found in glibc. When processing paths that start with a tilde (~) followed by a username, the `wordexp` function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhaustion and causing a denial of service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-19","epss":0.0022,"percentile":0.11673}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-19","epss":0.0022,"percentile":0.11673}],"risk":0.11990000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6791","description":"A flaw was found in glibc. When processing paths that start with a tilde (~) followed by a username, the `wordexp` function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhaustion and causing a denial of service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-19","epss":0.0022,"percentile":0.11673}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35191","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-35191","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35191","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35191","date":"2026-10-19","epss":0.00357,"percentile":0.27986}],"risk":0.11959499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-35191","description":"A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service (DoS) attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to calculate credit limits incorrectly by adding the total datagram size for each packet. Consequently, the server exceeds standard rate limits and transmits excessive response data to spoofed target addresses."},"relatedVulnerabilities":[{"id":"CVE-2026-35191","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35191","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35191","date":"2026-10-19","epss":0.00357,"percentile":0.27986}],"urls":["https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239","https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5","https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35191","description":"Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL's QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack.  If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-19","epss":0.00199,"percentile":0.09088}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"risk":0.11934,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-19","epss":0.00156,"percentile":0.04303}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41965","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-41965","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41965","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41965","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41965","date":"2026-10-19","epss":0.0033,"percentile":0.24695}],"risk":0.1188,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41965","description":"A vulnerability was found in Vim versions before 9.1.0648 that can cause the program to crash. This issue happens when a user abandons a modified file, and Vim tries to save it as an Untitled file. Due to a mistake in handling this process, Vim accidentally tries to free up memory twice, which can lead to problems, causing the program to crash. This issue can be exploited by someone with local access to the system."},"relatedVulnerabilities":[{"id":"CVE-2024-41965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41965","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41965","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41965","date":"2026-10-19","epss":0.0033,"percentile":0.24695}],"urls":["https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c","https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f","https://security.netapp.com/advisory/ntap-20241115-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41965","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41965","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-41965","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41965","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41965","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41965","date":"2026-10-19","epss":0.0033,"percentile":0.24695}],"risk":0.1188,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41965","description":"A vulnerability was found in Vim versions before 9.1.0648 that can cause the program to crash. This issue happens when a user abandons a modified file, and Vim tries to save it as an Untitled file. Due to a mistake in handling this process, Vim accidentally tries to free up memory twice, which can lead to problems, causing the program to crash. This issue can be exploited by someone with local access to the system."},"relatedVulnerabilities":[{"id":"CVE-2024-41965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41965","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-41965","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-41965","date":"2026-10-19","epss":0.0033,"percentile":0.24695}],"urls":["https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c","https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f","https://security.netapp.com/advisory/ntap-20241115-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41965","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28418","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28418","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28418","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28418","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28418","date":"2026-10-19","epss":0.0023,"percentile":0.13003}],"risk":0.11845,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28418","description":"A flaw was found in Vim. When processing a specially crafted Emacs-style tags file, a heap-based buffer overflow out-of-bounds read vulnerability allows an attacker to trick Vim into reading up to 7 bytes beyond its allocated memory boundary. This could lead to information disclosure or potentially affect the integrity of the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28418","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28418","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28418","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28418","date":"2026-10-19","epss":0.0023,"percentile":0.13003}],"urls":["https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb","https://github.com/vim/vim/releases/tag/v9.2.0074","https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j","http://www.openwall.com/lists/oss-security/2026/02/27/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28418","description":"Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28418","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28418","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28418","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28418","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28418","date":"2026-10-19","epss":0.0023,"percentile":0.13003}],"risk":0.11845,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28418","description":"A flaw was found in Vim. When processing a specially crafted Emacs-style tags file, a heap-based buffer overflow out-of-bounds read vulnerability allows an attacker to trick Vim into reading up to 7 bytes beyond its allocated memory boundary. This could lead to information disclosure or potentially affect the integrity of the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28418","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28418","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28418","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28418","date":"2026-10-19","epss":0.0023,"percentile":0.13003}],"urls":["https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb","https://github.com/vim/vim/releases/tag/v9.2.0074","https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j","http://www.openwall.com/lists/oss-security/2026/02/27/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28418","description":"Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66863","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-66863","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66863","date":"2026-10-19","epss":0.00376,"percentile":0.30108}],"risk":0.11843999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-66863","description":"A flaw was found in BinUtils. Attackers can exploit this vulnerability by providing a specially crafted Portable Executable (PE) file. This can lead to a denial of service, making the affected application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2025-66863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66863","date":"2026-10-19","epss":0.00376,"percentile":0.30108}],"urls":["https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash2.md"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66863","description":"An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66865","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-66865","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66865","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66865","date":"2026-10-19","epss":0.00376,"percentile":0.30107}],"risk":0.11843999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-66865","description":"A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a stack overflow in the d_print_comp_inner function in the cp-demangle.c file, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-66865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66865","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66865","date":"2026-10-19","epss":0.00376,"percentile":0.30107}],"urls":["https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash4.md"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66865","description":"An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file."}]},{"artifact":{"id":"18a5b947a6d195a9","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-58261","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-58261","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58261","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58261","date":"2026-10-19","epss":0.00398,"percentile":0.32565}],"risk":0.11741,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-58261","description":"A flaw was found in sequoia-openpgp. Processing RawCertParser operations with unsupported primary key types triggers an infinite loop of error messages. This flaw allows a local attacker to provide a specially crafted certificate file, resulting in a denial of service due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2024-58261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58261","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58261","date":"2026-10-19","epss":0.00398,"percentile":0.32565}],"urls":["https://crates.io/crates/sequoia-openpgp","https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106","https://rustsec.org/advisories/RUSTSEC-2024-0345.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-58261","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-19","epss":0.00349,"percentile":0.27057}],"risk":0.11691499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6276","description":"A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom `Host:` header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new `Host:` header. This can lead to libcurl incorrectly sending cookies intended for the first host to the second host, resulting in a cookie leak. This issue is categorized as an Origin Validation Error (CWE-346). Exploitation typically requires specific debugging configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-6276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-19","epss":0.00349,"percentile":0.27057}],"urls":["https://curl.se/docs/CVE-2026-6276.html","https://curl.se/docs/CVE-2026-6276.json","https://hackerone.com/reports/3671818","http://www.openwall.com/lists/oss-security/2026/04/29/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-19","epss":0.00349,"percentile":0.27057}],"risk":0.11691499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6276","description":"A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom `Host:` header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new `Host:` header. This can lead to libcurl incorrectly sending cookies intended for the first host to the second host, resulting in a cookie leak. This issue is categorized as an Origin Validation Error (CWE-346). Exploitation typically requires specific debugging configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-6276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-19","epss":0.00349,"percentile":0.27057}],"urls":["https://curl.se/docs/CVE-2026-6276.html","https://curl.se/docs/CVE-2026-6276.json","https://hackerone.com/reports/3671818","http://www.openwall.com/lists/oss-security/2026/04/29/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66862","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-66862","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66862","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66862","date":"2026-10-19","epss":0.0037,"percentile":0.2951}],"risk":0.11654999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-66862","description":"A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a heap-based buffer over-read in the gnu_special function in the cplus-dem.c file, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-66862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66862","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66862","date":"2026-10-19","epss":0.0037,"percentile":0.2951}],"urls":["https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash3.md"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66862","description":"A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84233","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"risk":0.1164,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84233","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"risk":0.1164,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84233","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"risk":0.1164,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84233","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"risk":0.1164,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84233","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-84233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"risk":0.1164,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."},"relatedVulnerabilities":[{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-19","epss":0.00194,"percentile":0.08545}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"18a5b947a6d195a9","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-53161","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-53161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53161","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53161","date":"2026-10-19","epss":0.00366,"percentile":0.29021}],"risk":0.11528999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-53161","description":"A flaw was found in buffered-reader. The crate's implementation contains an out-of-bounds array access, leading to a panic. A local attacker can trigger this condition by providing a specially crafted input. This occurs when processing data from an external source, which can result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-53161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53161","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53161","date":"2026-10-19","epss":0.00366,"percentile":0.29021}],"urls":["https://crates.io/crates/buffered-reader","https://github.com/advisories/GHSA-29mf-62xx-28jq","https://gitlab.com/sequoia-pgp/sequoia/-/tags/buffered-reader%2Fv1.0.2","https://gitlab.com/sequoia-pgp/sequoia/-/tags/buffered-reader%2Fv1.1.5","https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/","https://rustsec.org/advisories/RUSTSEC-2023-0039.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-53161","description":"The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45130","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-45130","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45130","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45130","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45130","date":"2026-10-19","epss":0.00197,"percentile":0.08867}],"risk":0.11425999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45130","description":"A flaw was found in Vim, an open-source command-line text editor. A heap buffer overflow exists in the `read_compound()` function when processing a specially crafted spell file (.spl) with UTF-8 encoding active. A remote attacker could exploit this by convincing a user to open a text file containing a malicious modeline, which could then load a planted malicious spell file. This could lead to a heap overflow, potentially resulting in an application-level denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-45130","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45130","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45130","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45130","date":"2026-10-19","epss":0.00197,"percentile":0.08867}],"urls":["https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8","https://github.com/vim/vim/releases/tag/v9.2.0450","https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv","http://www.openwall.com/lists/oss-security/2026/05/14/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45130","description":"Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45130","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-45130","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45130","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45130","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45130","date":"2026-10-19","epss":0.00197,"percentile":0.08867}],"risk":0.11425999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-45130","description":"A flaw was found in Vim, an open-source command-line text editor. A heap buffer overflow exists in the `read_compound()` function when processing a specially crafted spell file (.spl) with UTF-8 encoding active. A remote attacker could exploit this by convincing a user to open a text file containing a malicious modeline, which could then load a planted malicious spell file. This could lead to a heap overflow, potentially resulting in an application-level denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-45130","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45130","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45130","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45130","date":"2026-10-19","epss":0.00197,"percentile":0.08867}],"urls":["https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8","https://github.com/vim/vim/releases/tag/v9.2.0450","https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv","http://www.openwall.com/lists/oss-security/2026/05/14/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45130","description":"Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-19","epss":0.00373,"percentile":0.29812}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-19","epss":0.00373,"percentile":0.29812}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-19","epss":0.00373,"percentile":0.29812}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-19","epss":0.00373,"percentile":0.29812}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4516","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-4516","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-10-19","epss":0.00225,"percentile":0.12407}],"risk":0.11362499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-4516","description":"A vulnerability has been identified in CPython's bytes.decode() function when used with the \"unicode_escape\" encoding and the \"ignore\" or \"replace\" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches like data exfiltration, the resulting unexpected program behavior could introduce instability, logic errors, or unintended side effects within applications that rely on this specific decoding functionality."},"relatedVulnerabilities":[{"id":"CVE-2025-4516","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-10-19","epss":0.00225,"percentile":0.12407}],"urls":["https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292","https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d","https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142","https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f","https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77","https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e","https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b","https://github.com/python/cpython/issues/133767","https://github.com/python/cpython/pull/129648","https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/","http://www.openwall.com/lists/oss-security/2025/05/16/4","http://www.openwall.com/lists/oss-security/2025/05/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4516","description":"There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4516","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-4516","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-10-19","epss":0.00225,"percentile":0.12407}],"risk":0.11362499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-4516","description":"A vulnerability has been identified in CPython's bytes.decode() function when used with the \"unicode_escape\" encoding and the \"ignore\" or \"replace\" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches like data exfiltration, the resulting unexpected program behavior could introduce instability, logic errors, or unintended side effects within applications that rely on this specific decoding functionality."},"relatedVulnerabilities":[{"id":"CVE-2025-4516","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-10-19","epss":0.00225,"percentile":0.12407}],"urls":["https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292","https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d","https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142","https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f","https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77","https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e","https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b","https://github.com/python/cpython/issues/133767","https://github.com/python/cpython/pull/129648","https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/","http://www.openwall.com/lists/oss-security/2025/05/16/4","http://www.openwall.com/lists/oss-security/2025/05/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4516","description":"There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError."}]},{"artifact":{"id":"4489d023a8494b47","cpes":["cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/redhat/bind-libs@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78301","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78301","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-19","epss":0.00207,"percentile":0.10178}],"risk":0.11177999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78301","description":"A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own configured zones. As a result, if the server also performs recursive lookups, it might cache incorrect information provided by the attacker, leading to DNS cache poisoning and potentially redirecting users to malicious websites or services."},"relatedVulnerabilities":[{"id":"CVE-2026-78301","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-19","epss":0.00207,"percentile":0.10178}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-78301"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78301","description":"A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a2b7d84edf68dd88","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/redhat/bind-license@9.18.33-15.el10_2.12?arch=noarch&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78301","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78301","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-19","epss":0.00207,"percentile":0.10178}],"risk":0.11177999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78301","description":"A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own configured zones. As a result, if the server also performs recursive lookups, it might cache incorrect information provided by the attacker, leading to DNS cache poisoning and potentially redirecting users to malicious websites or services."},"relatedVulnerabilities":[{"id":"CVE-2026-78301","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-19","epss":0.00207,"percentile":0.10178}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-78301"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78301","description":"A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"378cdf1960b1b779","cpes":["cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.33-15.el10_2.12:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/redhat/bind-utils@9.18.33-15.el10_2.12?arch=x86_64&distro=rhel-10.2&epoch=32&upstream=bind-9.18.33-15.el10_2.12.src.rpm","type":"rpm","version":"32:9.18.33-15.el10_2.12","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.33-15.el10_2.12"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78301","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bind","version":"9.18.33-15.el10_2.12"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-78301","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-19","epss":0.00207,"percentile":0.10178}],"risk":0.11177999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78301","description":"A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own configured zones. As a result, if the server also performs recursive lookups, it might cache incorrect information provided by the attacker, leading to DNS cache poisoning and potentially redirecting users to malicious websites or services."},"relatedVulnerabilities":[{"id":"CVE-2026-78301","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-19","epss":0.00207,"percentile":0.10178}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-78301"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78301","description":"A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45306","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-45306","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45306","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-45306","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-45306","date":"2026-10-19","epss":0.00298,"percentile":0.21119}],"risk":0.11175,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-45306","description":"A heap-buffer overflow was found in Vim. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. It was assumed that this loop was unnecessary. However, this change made it possible for the cursor position to stay invalid and point beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position."},"relatedVulnerabilities":[{"id":"CVE-2024-45306","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45306","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-45306","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-45306","date":"2026-10-19","epss":0.00298,"percentile":0.21119}],"urls":["https://github.com/vim/vim/commit/396fd1ec2956307755392a1","https://github.com/vim/vim/releases/tag/v9.1.0038","https://github.com/vim/vim/security/advisories/GHSA-wxf9-c5gx-qrwr","https://security.netapp.com/advisory/ntap-20241004-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45306","description":"Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of\na line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at\nthe specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45306","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-45306","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45306","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-45306","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-45306","date":"2026-10-19","epss":0.00298,"percentile":0.21119}],"risk":0.11175,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-45306","description":"A heap-buffer overflow was found in Vim. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. It was assumed that this loop was unnecessary. However, this change made it possible for the cursor position to stay invalid and point beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position."},"relatedVulnerabilities":[{"id":"CVE-2024-45306","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45306","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-45306","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-45306","date":"2026-10-19","epss":0.00298,"percentile":0.21119}],"urls":["https://github.com/vim/vim/commit/396fd1ec2956307755392a1","https://github.com/vim/vim/releases/tag/v9.1.0038","https://github.com/vim/vim/security/advisories/GHSA-wxf9-c5gx-qrwr","https://security.netapp.com/advisory/ntap-20241004-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45306","description":"Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of\na line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at\nthe specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43802","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-43802","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43802","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43802","date":"2026-10-19","epss":0.00296,"percentile":0.20969}],"risk":0.11099999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43802","description":"A flaw was found in Vim. This issue may allow a heap-buffer overflow via improper management of the typeahead buffer, leading to crashes when error messages occur in combination with several long mappings."},"relatedVulnerabilities":[{"id":"CVE-2024-43802","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43802","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43802","date":"2026-10-19","epss":0.00296,"percentile":0.20969}],"urls":["https://github.com/vim/vim/commit/322ba9108612bead5eb","https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html","https://security.netapp.com/advisory/ntap-20241004-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43802","description":"Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters.  So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43802","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-43802","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43802","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43802","date":"2026-10-19","epss":0.00296,"percentile":0.20969}],"risk":0.11099999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43802","description":"A flaw was found in Vim. This issue may allow a heap-buffer overflow via improper management of the typeahead buffer, leading to crashes when error messages occur in combination with several long mappings."},"relatedVulnerabilities":[{"id":"CVE-2024-43802","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43802","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43802","date":"2026-10-19","epss":0.00296,"percentile":0.20969}],"urls":["https://github.com/vim/vim/commit/322ba9108612bead5eb","https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html","https://security.netapp.com/advisory/ntap-20241004-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43802","description":"Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters.  So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43374","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-43374","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43374","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43374","date":"2026-10-19","epss":0.00352,"percentile":0.27429}],"risk":0.11087999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43374","description":"A heap use-after-free vulnerability was found in Vim's alist_add() function. Adding a new file to the argument list triggers Buf* autocommands. In an autocommand, if the buffer that was just opened is closed, including the window where it is shown, it causes the window structure to be freed, containing a reference to the argument list that is being modified. Once the autocommands are completed, references to the window and argument list are no longer valid, causing a use-after-free issue. To trigger this issue, a local attacker or user must add unusual autocommands that wipe a buffer during creation, either manually or by sourcing a malicious plugin, which will cause Vim to crash."},"relatedVulnerabilities":[{"id":"CVE-2024-43374","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43374","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43374","date":"2026-10-19","epss":0.00352,"percentile":0.27429}],"urls":["https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8","https://github.com/vim/vim/security/advisories/GHSA-2w8m-443v-cgvw","http://www.openwall.com/lists/oss-security/2024/08/15/6","https://security.netapp.com/advisory/ntap-20240920-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43374","description":"The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43374","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-43374","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43374","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43374","date":"2026-10-19","epss":0.00352,"percentile":0.27429}],"risk":0.11087999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43374","description":"A heap use-after-free vulnerability was found in Vim's alist_add() function. Adding a new file to the argument list triggers Buf* autocommands. In an autocommand, if the buffer that was just opened is closed, including the window where it is shown, it causes the window structure to be freed, containing a reference to the argument list that is being modified. Once the autocommands are completed, references to the window and argument list are no longer valid, causing a use-after-free issue. To trigger this issue, a local attacker or user must add unusual autocommands that wipe a buffer during creation, either manually or by sourcing a malicious plugin, which will cause Vim to crash."},"relatedVulnerabilities":[{"id":"CVE-2024-43374","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43374","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-43374","date":"2026-10-19","epss":0.00352,"percentile":0.27429}],"urls":["https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8","https://github.com/vim/vim/security/advisories/GHSA-2w8m-443v-cgvw","http://www.openwall.com/lists/oss-security/2024/08/15/6","https://security.netapp.com/advisory/ntap-20240920-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43374","description":"The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-67693","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-67693","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-10-19","epss":0.00198,"percentile":0.09029}],"risk":0.10791000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-67693","description":"A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage (KU) and Extended Key Usage (EKU) extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could exploit this flaw by presenting a specially crafted certificate to bypass validation controls, potentially resulting in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-67693","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-10-19","epss":0.00198,"percentile":0.09029}],"urls":["http://gnutls.com","https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178","https://gitlab.com/gnutls/gnutls/-/work_items/1642"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693","description":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)"}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-1632","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1632","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-10-19","epss":0.00342,"percentile":0.26265}],"risk":0.10772999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1632","description":"A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior. This bug does not compromise the integrity or availability of the base system."},"relatedVulnerabilities":[{"id":"CVE-2025-1632","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-10-19","epss":0.00342,"percentile":0.26265}],"urls":["https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc","https://vuldb.com/?ctiid.296619","https://vuldb.com/?id.296619","https://vuldb.com/?submit.496460"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11081","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11081","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11081","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11081","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-11081","date":"2026-10-19","epss":0.00208,"percentile":0.10276}],"risk":0.10712,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11081","description":"An out of bounds read flaw has been discovered in GNU bin utilities. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access."},"relatedVulnerabilities":[{"id":"CVE-2025-11081","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11081","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11081","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-11081","date":"2026-10-19","epss":0.00208,"percentile":0.10276}],"urls":["https://github.com/user-attachments/files/20623354/hdf5_crash_3.txt","https://sourceware.org/bugzilla/show_bug.cgi?id=33406","https://sourceware.org/bugzilla/show_bug.cgi?id=33406#c2","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b","https://vuldb.com/?ctiid.326122","https://vuldb.com/?id.326122","https://vuldb.com/?submit.661275","https://www.gnu.org/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11081","description":"A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31789","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-31789","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-10-19","epss":0.00243,"percentile":0.1455}],"risk":0.10691999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-31789","description":"A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment."},"relatedVulnerabilities":[{"id":"CVE-2026-31789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-10-19","epss":0.00243,"percentile":0.1455}],"urls":["https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde","https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf","https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49","https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9","https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","description":"Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-70873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-70873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-10-19","epss":0.00332,"percentile":0.24967}],"risk":0.10457999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-70873","description":"A flaw was found in SQLite. This information disclosure vulnerability exists within the zipfile extension, specifically in the zipfileInflate function. A remote attacker could exploit this by providing a specially crafted ZIP file. Successful exploitation could lead to the disclosure of sensitive heap memory information."},"relatedVulnerabilities":[{"id":"CVE-2025-70873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-10-19","epss":0.00332,"percentile":0.24967}],"urls":["https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054","https://sqlite.org/forum/forumpost/761eac3c82","https://sqlite.org/src/info/3d459f1fb1bd1b5e","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-19","epss":0.00226,"percentile":0.12423}],"risk":0.10396,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19542","description":"A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-19","epss":0.00226,"percentile":0.12423}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-19","epss":0.00226,"percentile":0.12423}],"risk":0.10396,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19542","description":"A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-19","epss":0.00226,"percentile":0.12423}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-19","epss":0.00226,"percentile":0.12423}],"risk":0.10396,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19542","description":"A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-19","epss":0.00226,"percentile":0.12423}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56406","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56406","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56406","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56406","date":"2026-10-19","epss":0.00174,"percentile":0.06443}],"risk":0.10353000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56406","description":"A flaw was found in libexpat. An integer overflow vulnerability exists in the `XML_ParseBuffer` function due to a missing check. This flaw could allow an attacker to cause memory corruption, potentially leading to arbitrary code execution, information disclosure, or a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-56406","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56406","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56406","date":"2026-10-19","epss":0.00174,"percentile":0.06443}],"urls":["https://github.com/libexpat/libexpat/pull/1255"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56406","description":"libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56407","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56407","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56407","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56407","date":"2026-10-19","epss":0.00174,"percentile":0.06443}],"risk":0.10353000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56407","description":"An integer overflow exists in libexpat's doProlog function due to improper handling of entity value lengths. A local attacker could exploit this to execute arbitrary code or access sensitive system data."},"relatedVulnerabilities":[{"id":"CVE-2026-56407","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56407","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56407","date":"2026-10-19","epss":0.00174,"percentile":0.06443}],"urls":["https://github.com/libexpat/libexpat/pull/1262"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56407","description":"libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen."}]},{"artifact":{"id":"88615b9c65c046d5","cpes":["cpe:2.3:a:elfutils-default-yama-scope:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama-scope:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-default-yama-scope","purl":"pkg:rpm/redhat/elfutils-default-yama-scope@0.194-2.el10_2?arch=noarch&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1377","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1377","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1377","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1377","date":"2026-10-19","epss":0.00326,"percentile":0.24195}],"risk":0.10268999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1377","description":"A flaw was found in GNU elfutils. This vulnerability allows denial of service via manipulation of the gelf_getsymshndx function in strip.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1377","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1377","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1377","date":"2026-10-19","epss":0.00326,"percentile":0.24195}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15941","https://sourceware.org/bugzilla/show_bug.cgi?id=32673","https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2","https://vuldb.com/?ctiid.295985","https://vuldb.com/?id.295985","https://vuldb.com/?submit.497539","https://www.gnu.org/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1377","description":"A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"b6a3e05d2eda9579","cpes":["cpe:2.3:a:elfutils-libelf:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libelf:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-libelf","purl":"pkg:rpm/redhat/elfutils-libelf@0.194-2.el10_2?arch=x86_64&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1377","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1377","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1377","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1377","date":"2026-10-19","epss":0.00326,"percentile":0.24195}],"risk":0.10268999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1377","description":"A flaw was found in GNU elfutils. This vulnerability allows denial of service via manipulation of the gelf_getsymshndx function in strip.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1377","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1377","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1377","date":"2026-10-19","epss":0.00326,"percentile":0.24195}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15941","https://sourceware.org/bugzilla/show_bug.cgi?id=32673","https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2","https://vuldb.com/?ctiid.295985","https://vuldb.com/?id.295985","https://vuldb.com/?submit.497539","https://www.gnu.org/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1377","description":"A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"d718f6f178ab9612","cpes":["cpe:2.3:a:elfutils-libs:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libs:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-libs","purl":"pkg:rpm/redhat/elfutils-libs@0.194-2.el10_2?arch=x86_64&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1377","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1377","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1377","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1377","date":"2026-10-19","epss":0.00326,"percentile":0.24195}],"risk":0.10268999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1377","description":"A flaw was found in GNU elfutils. This vulnerability allows denial of service via manipulation of the gelf_getsymshndx function in strip.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1377","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1377","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1377","date":"2026-10-19","epss":0.00326,"percentile":0.24195}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15941","https://sourceware.org/bugzilla/show_bug.cgi?id=32673","https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2","https://vuldb.com/?ctiid.295985","https://vuldb.com/?id.295985","https://vuldb.com/?submit.497539","https://www.gnu.org/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1377","description":"A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-10-19","epss":0.0018,"percentile":0.07104}],"risk":0.10169999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12345","description":"A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup."},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-10-19","epss":0.0018,"percentile":0.07104}],"urls":["https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-10-19","epss":0.0018,"percentile":0.07104}],"risk":0.10169999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12345","description":"A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup."},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-10-19","epss":0.0018,"percentile":0.07104}],"urls":["https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-47814","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-47814","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47814","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47814","date":"2026-10-19","epss":0.00294,"percentile":0.20693}],"risk":0.10142999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-47814","description":"A flaw was found in Vim. When closing a buffer visible in a window, a `BufWinLeave` auto command can trigger a use-after-free if this auto command happens to reopen the same buffer in a new split window. This issue can potentially cause Vim to crash, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-47814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47814","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47814","date":"2026-10-19","epss":0.00294,"percentile":0.20693}],"urls":["https://github.com/vim/vim/commit/51b62387be93c65fa56bbabe1c3","https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html","https://security.netapp.com/advisory/ntap-20250411-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47814","description":"Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-47814","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2024-47814","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47814","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47814","date":"2026-10-19","epss":0.00294,"percentile":0.20693}],"risk":0.10142999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-47814","description":"A flaw was found in Vim. When closing a buffer visible in a window, a `BufWinLeave` auto command can trigger a use-after-free if this auto command happens to reopen the same buffer in a new split window. This issue can potentially cause Vim to crash, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-47814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47814","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47814","date":"2026-10-19","epss":0.00294,"percentile":0.20693}],"urls":["https://github.com/vim/vim/commit/51b62387be93c65fa56bbabe1c3","https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html","https://security.netapp.com/advisory/ntap-20250411-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47814","description":"Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"risk":0.100775,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"urls":["https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"risk":0.100775,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"urls":["https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"risk":0.100775,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"urls":["https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"risk":0.100775,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"urls":["https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"risk":0.100775,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"urls":["https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"risk":0.100775,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"urls":["https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53614","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53614","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"risk":0.100775,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53614","description":"A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53614","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53614","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53614","cwe":"CWE-807","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53614","date":"2026-10-19","epss":0.00139,"percentile":0.0293}],"urls":["https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-24014","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-24014","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24014","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24014","date":"2026-10-19","epss":0.00279,"percentile":0.19071}],"risk":0.10043999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-24014","description":"A flaw was found in Vim. In silent Ex mode (-s -e), Vim typically doesn't show a screen and operates silently in batch mode, however, it is possible to trigger the function that handles the scrolling of a GUI version of Vim via binary characters. The function that handles the scrolling may trigger a redraw, which will access the ScreenLines pointer and can cause a segmentation fault condition. This may lead to an application crash or other undefined behavior."},"relatedVulnerabilities":[{"id":"CVE-2025-24014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.8,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24014","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24014","date":"2026-10-19","epss":0.00279,"percentile":0.19071}],"urls":["https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919","https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955","http://www.openwall.com/lists/oss-security/2025/01/20/4","http://www.openwall.com/lists/oss-security/2025/01/21/1","https://security.netapp.com/advisory/ntap-20250314-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24014","description":"Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-24014","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-24014","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24014","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24014","date":"2026-10-19","epss":0.00279,"percentile":0.19071}],"risk":0.10043999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-24014","description":"A flaw was found in Vim. In silent Ex mode (-s -e), Vim typically doesn't show a screen and operates silently in batch mode, however, it is possible to trigger the function that handles the scrolling of a GUI version of Vim via binary characters. The function that handles the scrolling may trigger a redraw, which will access the ScreenLines pointer and can cause a segmentation fault condition. This may lead to an application crash or other undefined behavior."},"relatedVulnerabilities":[{"id":"CVE-2025-24014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.8,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24014","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24014","date":"2026-10-19","epss":0.00279,"percentile":0.19071}],"urls":["https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919","https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955","http://www.openwall.com/lists/oss-security/2025/01/20/4","http://www.openwall.com/lists/oss-security/2025/01/21/1","https://security.netapp.com/advisory/ntap-20250314-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24014","description":"Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56403","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56403","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56403","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56403","date":"2026-10-19","epss":0.00168,"percentile":0.0575}],"risk":0.09996000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56403","description":"A flaw was found in libexpat. An integer overflow vulnerability exists in the `storeAtts` function. This flaw could allow an attacker to corrupt memory, leading to a denial of service, information disclosure, or potentially arbitrary code execution, compromising the integrity and confidentiality of data."},"relatedVulnerabilities":[{"id":"CVE-2026-56403","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56403","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56403","date":"2026-10-19","epss":0.00168,"percentile":0.0575}],"urls":["https://github.com/libexpat/libexpat/pull/1232"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13595","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-13595","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"risk":0.09912,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-13595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13595","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13595","date":"2026-10-19","epss":0.00168,"percentile":0.05822}],"urls":["https://access.redhat.com/errata/RHSA-2026:26573","https://access.redhat.com/security/cve/CVE-2026-13595","https://bugzilla.redhat.com/show_bug.cgi?id=2494101","https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13595","description":"A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32777","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-32777","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32777","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32777","date":"2026-10-19","epss":0.0022,"percentile":0.11762}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32777","description":"A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing specially crafted Document Type Definition (DTD) content. This could lead to an infinite loop during parsing, resulting in a Denial of Service (DoS) for the application using libexpat."},"relatedVulnerabilities":[{"id":"CVE-2026-32777","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32777","cwe":"CWE-835","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32777","date":"2026-10-19","epss":0.0022,"percentile":0.11762}],"urls":["https://github.com/libexpat/libexpat/issues/1161","https://github.com/libexpat/libexpat/pull/1159","https://github.com/libexpat/libexpat/pull/1162","https://issues.oss-fuzz.com/issues/486993411","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32777","description":"libexpat before 2.7.5 allows an infinite loop while parsing DTD content."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66866","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-66866","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66866","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66866","date":"2026-10-19","epss":0.00311,"percentile":0.22542}],"risk":0.09796499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-66866","description":"A flaw was found in BinUtils. An attacker can exploit a vulnerability in the `d_abi_tags` function within the `cp-demangle.c` file by providing a specially crafted Portable Executable (PE) file. This can lead to a Denial of Service (DoS), making the affected application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2025-66866","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66866","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66866","date":"2026-10-19","epss":0.00311,"percentile":0.22542}],"urls":["https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash6.md"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66866","description":"An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-97399","description":"A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"18a5b947a6d195a9","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-53160","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-53160","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53160","date":"2026-10-19","epss":0.00302,"percentile":0.21595}],"risk":0.09512999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-53160","description":"A flaw was found in sequoia-openpgp. The crate exhibits an out-of-bounds array access, leading to a panic during processing. A local attacker can trigger this condition by providing a specially crafted input, which results in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-53160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53160","date":"2026-10-19","epss":0.00302,"percentile":0.21595}],"urls":["https://crates.io/crates/sequoia-openpgp","https://github.com/advisories/GHSA-25mx-8f3v-8wh7","https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/","https://rustsec.org/advisories/RUSTSEC-2023-0038.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-53160","description":"The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5915","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5915","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5915","date":"2026-10-19","epss":0.00197,"percentile":0.0884}],"risk":0.09456,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5915","description":"A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions."},"relatedVulnerabilities":[{"id":"CVE-2025-5915","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5915","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5915","date":"2026-10-19","epss":0.00197,"percentile":0.0884}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5915","https://bugzilla.redhat.com/show_bug.cgi?id=2370865","https://github.com/libarchive/libarchive/pull/2599","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5915","description":"A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28419","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28419","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28419","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28419","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28419","date":"2026-10-19","epss":0.00183,"percentile":0.07446}],"risk":0.09424500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28419","description":"A flaw was found in Vim, an open-source command-line text editor. This vulnerability, a heap-based buffer underflow, occurs when Vim processes a specially crafted Emacs-style tags file. If a malicious file with a delimiter at the start of a line is opened, Vim attempts to read memory outside its designated area. This could lead to the disclosure of sensitive information or cause the application to crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-28419","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28419","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28419","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28419","date":"2026-10-19","epss":0.00183,"percentile":0.07446}],"urls":["https://github.com/vim/vim/commit/9b7dfa2948c9e1e5e32a5812","https://github.com/vim/vim/releases/tag/v9.2.0075","https://github.com/vim/vim/security/advisories/GHSA-xcc8-r6c5-hvwv","http://www.openwall.com/lists/oss-security/2026/02/27/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28419","description":"Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28419","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-28419","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28419","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28419","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28419","date":"2026-10-19","epss":0.00183,"percentile":0.07446}],"risk":0.09424500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28419","description":"A flaw was found in Vim, an open-source command-line text editor. This vulnerability, a heap-based buffer underflow, occurs when Vim processes a specially crafted Emacs-style tags file. If a malicious file with a delimiter at the start of a line is opened, Vim attempts to read memory outside its designated area. This could lead to the disclosure of sensitive information or cause the application to crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-28419","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28419","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28419","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28419","date":"2026-10-19","epss":0.00183,"percentile":0.07446}],"urls":["https://github.com/vim/vim/commit/9b7dfa2948c9e1e5e32a5812","https://github.com/vim/vim/releases/tag/v9.2.0075","https://github.com/vim/vim/security/advisories/GHSA-xcc8-r6c5-hvwv","http://www.openwall.com/lists/oss-security/2026/02/27/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28419","description":"Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-19","epss":0.00126,"percentile":0.02067}],"risk":0.09387,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89161","description":"A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code."},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-19","epss":0.00126,"percentile":0.02067}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-19","epss":0.00126,"percentile":0.02067}],"risk":0.09387,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89161","description":"A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code."},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-19","epss":0.00126,"percentile":0.02067}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32776","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-32776","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32776","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32776","date":"2026-10-19","epss":0.00167,"percentile":0.0558}],"risk":0.09352,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32776","description":"A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing specially crafted XML content with empty external parameter entities. This could lead to a NULL pointer dereference, causing the application to crash and resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-32776","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32776","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32776","date":"2026-10-19","epss":0.00167,"percentile":0.0558}],"urls":["https://github.com/libexpat/libexpat/pull/1158","https://github.com/libexpat/libexpat/pull/1159","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32776","description":"libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"risk":0.0928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"risk":0.0928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"risk":0.0928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"risk":0.0928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"risk":0.0928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"risk":0.0928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"risk":0.0928,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-10-19","epss":0.00128,"percentile":0.02179}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"risk":0.09216,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"risk":0.09216,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"risk":0.09216,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"risk":0.09216,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95519","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95519","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"risk":0.09216,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."},"relatedVulnerabilities":[{"id":"CVE-2026-95519","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95519","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95519","date":"2026-10-19","epss":0.00144,"percentile":0.03291}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95519","https://bugzilla.redhat.com/show_bug.cgi?id=2470977"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95519","description":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}]},{"artifact":{"id":"e1f68ab5ba7614fd","cpes":["cpe:2.3:a:bzip2-libs:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2-libs:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2_libs:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2_libs:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2:bzip2-libs:1.0.8-25.el10:*:*:*:*:*:*:*","cpe:2.3:a:bzip2:bzip2_libs:1.0.8-25.el10:*:*:*:*:*:*:*"],"name":"bzip2-libs","purl":"pkg:rpm/redhat/bzip2-libs@1.0.8-25.el10?arch=x86_64&distro=rhel-10.2&upstream=bzip2-1.0.8-25.el10.src.rpm","type":"rpm","version":"1.0.8-25.el10","language":"","licenses":["BSD-4-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bzip2","version":"1.0.8-25.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42250","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"bzip2","version":"1.0.8-25.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-10-19","epss":0.00182,"percentile":0.07374}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42250","description":"A flaw was found in bzip2. The bzip2recover utility contains an off-by-one error that allows a local attacker to cause an out-of-bounds write to a global buffer by processing a specially crafted file. This memory corruption can lead to a crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-42250","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-10-19","epss":0.00182,"percentile":0.07374}],"urls":["https://cert.pl/en/posts/2026/05/CVE-2026-42250/","https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/","https://sourceware.org/bzip2/","https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"}]},{"artifact":{"id":"4a2239ff883d6ac5","cpes":["cpe:2.3:a:redhat:nano:8.1-3.el10:*:*:*:*:*:*:*","cpe:2.3:a:nano:nano:8.1-3.el10:*:*:*:*:*:*:*"],"name":"nano","purl":"pkg:rpm/redhat/nano@8.1-3.el10?arch=x86_64&distro=rhel-10.2&upstream=nano-8.1-3.el10.src.rpm","type":"rpm","version":"8.1-3.el10","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6390","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"nano","version":"0:8.1-3.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6390","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","metrics":{"baseScore":6.8,"impactScore":5.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6390","cwe":"CWE-134","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6390","date":"2026-10-19","epss":0.00154,"percentile":0.04125}],"risk":0.09085999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6390","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes."},"relatedVulnerabilities":[{"id":"CVE-2026-6390","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","metrics":{"baseScore":6.8,"impactScore":5.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6390","cwe":"CWE-134","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6390","date":"2026-10-19","epss":0.00154,"percentile":0.04125}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6390","https://bugzilla.redhat.com/show_bug.cgi?id=2458767"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6390","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes."}]},{"artifact":{"id":"beb40ba9101c0bc0","cpes":["cpe:2.3:a:systemd:systemd:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/redhat/systemd@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"0:257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-19","epss":0.00155,"percentile":0.04176}],"risk":0.09067499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-19","epss":0.00155,"percentile":0.04176}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"a180667717d94fe1","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"257-23.el10_2.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-19","epss":0.00155,"percentile":0.04176}],"risk":0.09067499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-19","epss":0.00155,"percentile":0.04176}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"7d7d4c86dfd32268","cpes":["cpe:2.3:a:systemd-pam:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/redhat/systemd-pam@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"257-23.el10_2.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4105","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-4105","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-19","epss":0.00155,"percentile":0.04176}],"risk":0.09067499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."},"relatedVulnerabilities":[{"id":"CVE-2026-4105","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4105","cwe":"CWE-284","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4105","date":"2026-10-19","epss":0.00155,"percentile":0.04176}],"urls":["https://access.redhat.com/errata/RHSA-2026:7299","https://access.redhat.com/security/cve/CVE-2026-4105","https://bugzilla.redhat.com/show_bug.cgi?id=2447262","https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4105","description":"A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-60753","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-60753","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-10-19","epss":0.00172,"percentile":0.06214}],"risk":0.0903,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-60753","description":"A vulnerability in apply_substitution() function in libarchive's bsdtar allows crafted -s substitution rules to repeatedly match a zero-length substring and append replacements without advancing the input pointer. When the rule uses the global /g flag (or an explicitly empty pattern), this leads to unbounded output allocation and eventual process OOM (Denial of Service). Upgrade to libarchive 3.8.1 or apply a patch that prevents zero-length match loops or rejects empty patterns."},"relatedVulnerabilities":[{"id":"CVE-2025-60753","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-10-19","epss":0.00172,"percentile":0.06214}],"urls":["https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753","https://github.com/libarchive/libarchive/issues/2725"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60753","description":"An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash)."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"risk":0.08978,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89160","description":"A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"risk":0.08978,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89160","description":"A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5745","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5745","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5745","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5745","date":"2026-10-19","epss":0.00171,"percentile":0.06132}],"risk":0.089775,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5745","description":"A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-5745","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5745","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5745","date":"2026-10-19","epss":0.00171,"percentile":0.06132}],"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-5745","https://bugzilla.redhat.com/show_bug.cgi?id=2455921"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5745","description":"A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS)."}]},{"artifact":{"id":"473fece84d4e5a84","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:23.3.2-11.el10_2:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@23.3.2-11.el10_2?arch=noarch&distro=rhel-10.2&upstream=python-pip-23.3.2-11.el10_2.src.rpm","type":"rpm","version":"23.3.2-11.el10_2","language":"","licenses":["MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"23.3.2-11.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25645","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python-pip","version":"23.3.2-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-25645","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25645","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25645","date":"2026-10-19","epss":0.00185,"percentile":0.07646}],"risk":0.089725,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-25645","description":"A flaw was found in the `requests` HTTP library, specifically in the `requests.utils.extract_zipped_paths()` function, which is used to load Certificate Authority (CA) bundles. A local attacker can exploit this vulnerability by pre-creating a malicious CA bundle file in the system's temporary directory. When a vulnerable application initializes the `requests` library, it may load this malicious file instead of the legitimate CA bundle, leading to a bypass of security controls and potential integrity compromise."},"relatedVulnerabilities":[{"id":"CVE-2026-25645","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25645","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25645","date":"2026-10-19","epss":0.00185,"percentile":0.07646}],"urls":["https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7","https://github.com/psf/requests/releases/tag/v2.33.0","https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35189","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-19","epss":0.00267,"percentile":0.17666}],"risk":0.089445,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-35189","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by presenting a specially crafted certificate during a Transport Layer Security (TLS) handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List (CRL) distribution points, it allocates an excessive amount of memory. This disproportionate memory usage can exhaust system resources and crash the affected client or server application."},"relatedVulnerabilities":[{"id":"CVE-2026-35189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-19","epss":0.00267,"percentile":0.17666}],"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-39804","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2023-39804","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39804","date":"2026-10-19","epss":0.00283,"percentile":0.19514}],"risk":0.08914499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-39804","description":"A flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-39804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39804","date":"2026-10-19","epss":0.00283,"percentile":0.19514}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079","https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4","https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723","https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42308","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42308","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42308","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42308","date":"2026-10-19","epss":0.00159,"percentile":0.04593}],"risk":0.08904000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42308","description":"A flaw was found in Pillow, a Python imaging library. If a font advances for each glyph by an exceeding large amount, an integer overflow can occur when Pillow tracks the current position. This could lead to a denial of service (DoS) condition, making the application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-42308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42308","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42308","date":"2026-10-19","epss":0.00159,"percentile":0.04593}],"urls":["https://github.com/python-pillow/Pillow/releases/tag/12.2.0","https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308","description":"Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42308","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42308","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42308","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42308","date":"2026-10-19","epss":0.00159,"percentile":0.04593}],"risk":0.08904000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42308","description":"A flaw was found in Pillow, a Python imaging library. If a font advances for each glyph by an exceeding large amount, an integer overflow can occur when Pillow tracks the current position. This could lead to a denial of service (DoS) condition, making the application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-42308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42308","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42308","date":"2026-10-19","epss":0.00159,"percentile":0.04593}],"urls":["https://github.com/python-pillow/Pillow/releases/tag/12.2.0","https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308","description":"Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-3198","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-3198","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3198","cwe":"CWE-401","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-3198","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-3198","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-3198","date":"2026-10-19","epss":0.00282,"percentile":0.19415}],"risk":0.08882999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-3198","description":"A flaw was found in GNU Binutils. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally."},"relatedVulnerabilities":[{"id":"CVE-2025-3198","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3198","cwe":"CWE-401","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-3198","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-3198","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-3198","date":"2026-10-19","epss":0.00282,"percentile":0.19415}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32716","https://sourceware.org/bugzilla/show_bug.cgi?id=32716#c0","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d","https://vuldb.com/?ctiid.303151","https://vuldb.com/?id.303151","https://vuldb.com/?submit.545773","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3198","description":"A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56412","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56412","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56412","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56412","date":"2026-10-19","epss":0.00179,"percentile":0.07004}],"risk":0.088605,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56412","description":"A flaw was found in libexpat. This vulnerability, present in versions before 2.8.2, stems from improper handling of XML CDATA sections, where the library fails to adequately track the depth of handler calls. This can result in a 'use-after-free' error, a type of memory corruption that could allow an attacker to crash the application or potentially gain unauthorized control."},"relatedVulnerabilities":[{"id":"CVE-2026-56412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56412","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56412","date":"2026-10-19","epss":0.00179,"percentile":0.07004}],"urls":["https://github.com/libexpat/libexpat/pull/1278"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56412","description":"libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32778","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-32778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32778","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32778","date":"2026-10-19","epss":0.00174,"percentile":0.06428}],"risk":0.08787,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32778","description":"A flaw was found in libexpat. This vulnerability allows an attacker to trigger a NULL pointer dereference in the `setContext` function. This occurs when the system attempts to retry an operation after an out-of-memory condition, which can lead to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-32778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32778","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-32778","date":"2026-10-19","epss":0.00174,"percentile":0.06428}],"urls":["https://github.com/libexpat/libexpat/pull/1159","https://github.com/libexpat/libexpat/pull/1163","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32778","description":"libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11839","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11839","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11839","cwe":"CWE-252","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11839","cwe":"CWE-253","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11839","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11839","date":"2026-10-19","epss":0.00276,"percentile":0.18808}],"risk":0.08693999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11839","description":"An uncheck return value flaw has been discovered in the GNU binutils program. This flaw exists in the `tg_tag_type` function of the file prdbg.c and exploitation of this flaw may lead to a program crash."},"relatedVulnerabilities":[{"id":"CVE-2025-11839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11839","cwe":"CWE-252","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11839","cwe":"CWE-253","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11839","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11839","date":"2026-10-19","epss":0.00276,"percentile":0.18808}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16344","https://sourceware.org/bugzilla/show_bug.cgi?id=33448","https://vuldb.com/?ctiid.328774","https://vuldb.com/?id.328774","https://vuldb.com/?submit.661279","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11839","description":"A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11840","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11840","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11840","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11840","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11840","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11840","date":"2026-10-19","epss":0.00276,"percentile":0.18808}],"risk":0.08693999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11840","description":"An out of bounds read flaw has been discovered in GNU binutils. The `vfinfo` function in the `ldmisc.c` file. Exploitation of this flaw requires local access and may cause a program crash."},"relatedVulnerabilities":[{"id":"CVE-2025-11840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11840","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11840","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11840","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11840","date":"2026-10-19","epss":0.00276,"percentile":0.18808}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16351","https://sourceware.org/bugzilla/attachment.cgi?id=16357","https://sourceware.org/bugzilla/show_bug.cgi?id=33455","https://vuldb.com/?ctiid.328775","https://vuldb.com/?id.328775","https://vuldb.com/?submit.661281","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11840","description":"A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue."}]},{"artifact":{"id":"00df98568369ced1","cpes":["cpe:2.3:a:redhat:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.44-1.el10.3?arch=x86_64&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"0:10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"risk":0.08672999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89156","description":"A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"16318bddc7235dfc","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.44-1.el10.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.44-1.el10.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/redhat/pcre2-syntax@10.44-1.el10.3?arch=noarch&distro=rhel-10.2&upstream=pcre2-10.44-1.el10.3.src.rpm","type":"rpm","version":"10.44-1.el10.3","language":"","licenses":["BSD-3-Clause AND FSFULLR AND X11 AND GPL-2.0-or-later AND FSFAP AND FSFUL AND GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.44-1.el10.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.44-1.5.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"< 0:10.44-1.5.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pcre2","version":"10.44-1.el10.3"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"fixed","versions":["0:10.44-1.5.el10_2"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.44-1.5.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"risk":0.08672999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:81522","link":"https://access.redhat.com/errata/RHSA-2026:81522"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89156","description":"A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53655","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53655","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53655","date":"2026-10-19","epss":0.00156,"percentile":0.04367}],"risk":0.08657999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53655","description":"A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to other standard tar implementations. A remote attacker could exploit this by crafting a malicious archive, causing different interpretations of archive contents between node-tar and other tools. This could allow an attacker to hide malicious files or sensitive information from security scanners that rely on different tar parsing libraries, potentially leading to information disclosure or bypassing security controls."},"relatedVulnerabilities":[{"id":"CVE-2026-53655","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53655","date":"2026-10-19","epss":0.00156,"percentile":0.04367}],"urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16."}]},{"artifact":{"id":"4c587e26eda1e82b","cpes":["cpe:2.3:a:libsolv:libsolv:0.7.33-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsolv:0.7.33-5.el10_2:*:*:*:*:*:*:*"],"name":"libsolv","purl":"pkg:rpm/redhat/libsolv@0.7.33-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libsolv-0.7.33-5.el10_2.src.rpm","type":"rpm","version":"0.7.33-5.el10_2","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82327","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libsolv","version":"0:0.7.33-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-82327","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82327","cwe":"CWE-129","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-82327","date":"2026-10-19","epss":0.00163,"percentile":0.05119}],"risk":0.085575,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82327","description":"A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value."},"relatedVulnerabilities":[{"id":"CVE-2026-82327","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82327","cwe":"CWE-129","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-82327","date":"2026-10-19","epss":0.00163,"percentile":0.05119}],"urls":["https://access.redhat.com/security/cve/CVE-2026-82327","https://bugzilla.redhat.com/show_bug.cgi?id=2525602"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82327","description":"A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-26603","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-26603","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26603","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-26603","date":"2026-10-19","epss":0.00237,"percentile":0.13835}],"risk":0.08532000000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-26603","description":"A flaw was found in Vim's :redir command. This vulnerability allows a use-after-free condition via redirecting the :display command to a clipboard register (* or +), which allows access to freed memory."},"relatedVulnerabilities":[{"id":"CVE-2025-26603","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26603","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-26603","date":"2026-10-19","epss":0.00237,"percentile":0.13835}],"urls":["https://github.com/vim/vim/commit/c0f0e2380e5954f4a52a131bf6b8","https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v","https://security.netapp.com/advisory/ntap-20250306-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-26603","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-26603","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-26603","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26603","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-26603","date":"2026-10-19","epss":0.00237,"percentile":0.13835}],"risk":0.08532000000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-26603","description":"A flaw was found in Vim's :redir command. This vulnerability allows a use-after-free condition via redirecting the :display command to a clipboard register (* or +), which allows access to freed memory."},"relatedVulnerabilities":[{"id":"CVE-2025-26603","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26603","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-26603","date":"2026-10-19","epss":0.00237,"percentile":0.13835}],"urls":["https://github.com/vim/vim/commit/c0f0e2380e5954f4a52a131bf6b8","https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v","https://security.netapp.com/advisory/ntap-20250306-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-26603","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability."}]},{"artifact":{"id":"88615b9c65c046d5","cpes":["cpe:2.3:a:elfutils-default-yama-scope:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama-scope:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-default-yama-scope","purl":"pkg:rpm/redhat/elfutils-default-yama-scope@0.194-2.el10_2?arch=noarch&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1376","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1376","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-19","epss":0.00309,"percentile":0.22257}],"risk":0.08497500000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1376","description":"A flaw was found in GNU elfutils. This vulnerability allows denial of service via manipulation of the function elf_strptr in /libelf/elf_strptr.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1,"impactScore":2.9,"exploitabilityScore":1.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-19","epss":0.00309,"percentile":0.22257}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15940","https://sourceware.org/bugzilla/show_bug.cgi?id=32672","https://sourceware.org/bugzilla/show_bug.cgi?id=32672#c3","https://vuldb.com/?ctiid.295984","https://vuldb.com/?id.295984","https://vuldb.com/?submit.497538","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1376","description":"A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"b6a3e05d2eda9579","cpes":["cpe:2.3:a:elfutils-libelf:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libelf:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-libelf","purl":"pkg:rpm/redhat/elfutils-libelf@0.194-2.el10_2?arch=x86_64&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1376","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1376","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-19","epss":0.00309,"percentile":0.22257}],"risk":0.08497500000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1376","description":"A flaw was found in GNU elfutils. This vulnerability allows denial of service via manipulation of the function elf_strptr in /libelf/elf_strptr.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1,"impactScore":2.9,"exploitabilityScore":1.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-19","epss":0.00309,"percentile":0.22257}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15940","https://sourceware.org/bugzilla/show_bug.cgi?id=32672","https://sourceware.org/bugzilla/show_bug.cgi?id=32672#c3","https://vuldb.com/?ctiid.295984","https://vuldb.com/?id.295984","https://vuldb.com/?submit.497538","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1376","description":"A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"d718f6f178ab9612","cpes":["cpe:2.3:a:elfutils-libs:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libs:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-libs","purl":"pkg:rpm/redhat/elfutils-libs@0.194-2.el10_2?arch=x86_64&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1376","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1376","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-19","epss":0.00309,"percentile":0.22257}],"risk":0.08497500000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1376","description":"A flaw was found in GNU elfutils. This vulnerability allows denial of service via manipulation of the function elf_strptr in /libelf/elf_strptr.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1,"impactScore":2.9,"exploitabilityScore":1.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-19","epss":0.00309,"percentile":0.22257}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15940","https://sourceware.org/bugzilla/show_bug.cgi?id=32672","https://sourceware.org/bugzilla/show_bug.cgi?id=32672#c3","https://vuldb.com/?ctiid.295984","https://vuldb.com/?id.295984","https://vuldb.com/?submit.497538","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1376","description":"A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5713","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5713","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5713","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-5713","cwe":"CWE-125","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-5713","date":"2026-10-19","epss":0.00153,"percentile":0.04045}],"risk":0.08415,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5713","description":"A flaw was found in Python. A malicious Python process could exploit the \"profiling.sampling\" module and \"asyncio introspection capabilities\" to read and write memory addresses within a privileged process. This vulnerability occurs when the privileged process connects to the malicious process via its remote debugging feature, potentially leading to information disclosure and arbitrary code execution. Successful exploitation requires repeated connections, which may cause instability in the connecting process."},"relatedVulnerabilities":[{"id":"CVE-2026-5713","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5713","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-5713","cwe":"CWE-125","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-5713","date":"2026-10-19","epss":0.00153,"percentile":0.04045}],"urls":["https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67","https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d","https://github.com/python/cpython/issues/148178","https://github.com/python/cpython/pull/148187","https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/","http://www.openwall.com/lists/oss-security/2026/04/15/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5713","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5713","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5713","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5713","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-5713","cwe":"CWE-125","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-5713","date":"2026-10-19","epss":0.00153,"percentile":0.04045}],"risk":0.08415,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5713","description":"A flaw was found in Python. A malicious Python process could exploit the \"profiling.sampling\" module and \"asyncio introspection capabilities\" to read and write memory addresses within a privileged process. This vulnerability occurs when the privileged process connects to the malicious process via its remote debugging feature, potentially leading to information disclosure and arbitrary code execution. Successful exploitation requires repeated connections, which may cause instability in the connecting process."},"relatedVulnerabilities":[{"id":"CVE-2026-5713","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5713","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-5713","cwe":"CWE-125","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-5713","date":"2026-10-19","epss":0.00153,"percentile":0.04045}],"urls":["https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67","https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d","https://github.com/python/cpython/issues/148178","https://github.com/python/cpython/pull/148187","https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/","http://www.openwall.com/lists/oss-security/2026/04/15/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5713","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR."}]},{"artifact":{"id":"45431d1c18d6fa58","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.46.1-6.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.46.1-6.el10_2:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.46.1-6.el10_2?arch=x86_64&distro=rhel-10.2&upstream=sqlite-3.46.1-6.el10_2.src.rpm","type":"rpm","version":"3.46.1-6.el10_2","language":"","licenses":["blessing"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.46.1-6.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50812","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sqlite","version":"3.46.1-6.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-50812","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-19","epss":0.0016,"percentile":0.04742}],"risk":0.084,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-50812","description":"A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-50812","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-19","epss":0.0016,"percentile":0.04742}],"urls":["https://gist.github.com/junius-sec/bb556f333957c5226dede314db0e9e91","https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb1383549f2a18aa35508385d","https://sqlite.org/src/info/e807d4e3798efd53"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50812","description":"A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69649","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69649","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69649","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69649","date":"2026-10-19","epss":0.00266,"percentile":0.17607}],"risk":0.08378999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69649","description":"A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed header fields with the readelf program can trigger a NULL pointer dereference, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-69649","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69649","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69649","date":"2026-10-19","epss":0.00266,"percentile":0.17607}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33697","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=66a3492ce68e1ae45b2489bd9a815c39ea5d7f66"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69649","description":"GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"risk":0.08337499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"urls":["https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"risk":0.08337499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"urls":["https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"risk":0.08337499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"urls":["https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"risk":0.08337499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"urls":["https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"risk":0.08337499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"urls":["https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"risk":0.08337499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"urls":["https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53612","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-53612","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"risk":0.08337499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53612","description":"A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53612","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53612","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53612","date":"2026-10-19","epss":0.00115,"percentile":0.01455}],"urls":["https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","description":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56131","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"impactScore":3.4,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56131","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56131","date":"2026-10-19","epss":0.00175,"percentile":0.06623}],"risk":0.08312499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56131","description":"A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XML_ResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-56131","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56131","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56131","date":"2026-10-19","epss":0.00175,"percentile":0.06623}],"urls":["https://github.com/libexpat/libexpat/pull/1267"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56131","description":"libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation)."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32249","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-32249","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32249","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32249","date":"2026-10-19","epss":0.00193,"percentile":0.08409}],"risk":0.08202500000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32249","description":"A flaw was found in Vim. A NULL pointer dereference can occur when the NFA regex compiler processes a specific character collection, more specifically one that contains a combining character acting as the endpoint of a character range (e.g., [0-0\\u05bb]). A process or user that can supply a regex pattern can cause an application crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-32249","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32249","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32249","date":"2026-10-19","epss":0.00193,"percentile":0.08409}],"urls":["https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec","https://github.com/vim/vim/releases/tag/v9.2.0137","https://github.com/vim/vim/security/advisories/GHSA-9phh-423r-778r"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32249","description":"Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32249","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-32249","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32249","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32249","date":"2026-10-19","epss":0.00193,"percentile":0.08409}],"risk":0.08202500000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32249","description":"A flaw was found in Vim. A NULL pointer dereference can occur when the NFA regex compiler processes a specific character collection, more specifically one that contains a combining character acting as the endpoint of a character range (e.g., [0-0\\u05bb]). A process or user that can supply a regex pattern can cause an application crash, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-32249","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32249","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32249","date":"2026-10-19","epss":0.00193,"percentile":0.08409}],"urls":["https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec","https://github.com/vim/vim/releases/tag/v9.2.0137","https://github.com/vim/vim/security/advisories/GHSA-9phh-423r-778r"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32249","description":"Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11413","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11413","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11413","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11413","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11413","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11413","date":"2026-10-19","epss":0.00219,"percentile":0.11608}],"risk":0.08103,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11413","description":"A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds write in the bfd_putl64 function in the bfd/libbfd.c file due to an improper check, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-11413","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11413","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11413","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11413","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11413","date":"2026-10-19","epss":0.00219,"percentile":0.11608}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16362","https://sourceware.org/bugzilla/show_bug.cgi?id=33452","https://sourceware.org/bugzilla/show_bug.cgi?id=33456#c10","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0","https://vuldb.com/?ctiid.327349","https://vuldb.com/?id.327349","https://vuldb.com/?submit.665587","https://vuldb.com/?submit.665590","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11413","description":"A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15003","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-15003","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15003","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15003","date":"2026-10-19","epss":0.00151,"percentile":0.03831}],"risk":0.08003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15003","description":"A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could exploit this by providing a malicious file, leading to an out-of-bounds read of memory. This can result in information disclosure, potentially revealing sensitive heap data, and a Denial of Service (DoS) due to the linker crashing."},"relatedVulnerabilities":[{"id":"CVE-2026-15003","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15003","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15003","date":"2026-10-19","epss":0.00151,"percentile":0.03831}],"urls":["https://access.redhat.com/errata/RHSA-2026:47171","https://access.redhat.com/security/cve/CVE-2026-15003","https://bugzilla.redhat.com/show_bug.cgi?id=2497805","https://sourceware.org/bugzilla/show_bug.cgi?id=34053"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15003","description":"A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could exploit this by providing a malicious file, leading to an out-of-bounds read of memory. This can result in information disclosure, potentially revealing sensitive heap data, and a Denial of Service (DoS) due to the linker crashing."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3479","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3479","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3479","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3479","date":"2026-10-19","epss":0.00254,"percentile":0.15947}],"risk":0.08000999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3479","description":"A flaw was found in Python's `pkgutil.get_data()` function, which is used to retrieve data from packages. This function did not properly validate the `resource` argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories stored outside the intended root directory, potentially leading to information disclosure or unintended file access."},"relatedVulnerabilities":[{"id":"CVE-2026-3479","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3479","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3479","date":"2026-10-19","epss":0.00254,"percentile":0.15947}],"urls":["https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe","https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7","https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943","https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c","https://github.com/python/cpython/issues/146121","https://github.com/python/cpython/pull/146122","https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3479","description":"DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.\n\npkgutil.get_data() did not validate the resource argument as documented, allowing path traversals."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3479","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-3479","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3479","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3479","date":"2026-10-19","epss":0.00254,"percentile":0.15947}],"risk":0.08000999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3479","description":"A flaw was found in Python's `pkgutil.get_data()` function, which is used to retrieve data from packages. This function did not properly validate the `resource` argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories stored outside the intended root directory, potentially leading to information disclosure or unintended file access."},"relatedVulnerabilities":[{"id":"CVE-2026-3479","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3479","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3479","date":"2026-10-19","epss":0.00254,"percentile":0.15947}],"urls":["https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe","https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7","https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943","https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c","https://github.com/python/cpython/issues/146121","https://github.com/python/cpython/pull/146122","https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3479","description":"DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.\n\npkgutil.get_data() did not validate the resource argument as documented, allowing path traversals."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75803","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-19","epss":0.00232,"percentile":0.13132}],"risk":0.07772,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75803","description":"A flaw in OpenSSL causes EVP_Cipher() to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid."},"relatedVulnerabilities":[{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-19","epss":0.00232,"percentile":0.13132}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"18a5b947a6d195a9","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-75803","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-19","epss":0.00232,"percentile":0.13132}],"risk":0.07772,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75803","description":"A flaw in OpenSSL causes EVP_Cipher() to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid."},"relatedVulnerabilities":[{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-19","epss":0.00232,"percentile":0.13132}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"3217cb7fb1163bcd","cpes":["cpe:2.3:a:redhat:sed:4.9-5.el10:*:*:*:*:*:*:*","cpe:2.3:a:sed:sed:4.9-5.el10:*:*:*:*:*:*:*"],"name":"sed","purl":"pkg:rpm/redhat/sed@4.9-5.el10?arch=x86_64&distro=rhel-10.2&upstream=sed-4.9-5.el10.src.rpm","type":"rpm","version":"4.9-5.el10","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5958","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"sed","version":"0:4.9-5.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-5958","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-10-19","epss":0.00137,"percentile":0.02813}],"risk":0.07740499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5958","description":"A Time-of-Check Time-of-Use (TOCTOU) race condition was found in GNU sed. When the -i (in-place) and --follow-symlinks options are used together, sed resolves the symlink but reopens the path for writing. An attacker with write access to the directory containing the symlink can swap it between the check and the open operations. If a privileged user executes sed in this manner on a path influenced by the attacker, it can lead to arbitrary file overwrites and potential privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-5958","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5958","cwe":"CWE-367","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-5958","date":"2026-10-19","epss":0.00137,"percentile":0.02813}],"urls":["https://cert.pl/en/posts/2026/04/CVE-2026-5958","https://www.gnu.org/software/sed/","http://www.openwall.com/lists/oss-security/2026/05/13/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5958","description":"When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores the resolved path for determining when output is written,\n2. opens the original symlink path (not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.0774,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95818","description":"A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory."},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56404","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56404","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56404","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56404","date":"2026-10-19","epss":0.0013,"percentile":0.02327}],"risk":0.07734999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56404","description":"A flaw was found in libexpat. This vulnerability, an integer overflow in the `addBinding` function, could allow a local attacker to execute arbitrary code. By exploiting this, an attacker could gain control over the affected system, compromising its confidentiality and integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-56404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56404","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56404","date":"2026-10-19","epss":0.0013,"percentile":0.02327}],"urls":["https://github.com/libexpat/libexpat/pull/1249"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56404","description":"libexpat before 2.8.2 has an integer overflow in addBinding."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6844","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6844","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6844","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6844","date":"2026-10-19","epss":0.00147,"percentile":0.03552}],"risk":0.077175,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6844","description":"A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-6844","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6844","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6844","date":"2026-10-19","epss":0.00147,"percentile":0.03552}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6844","https://bugzilla.redhat.com/show_bug.cgi?id=2460016"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6844","description":"A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service."}]},{"artifact":{"id":"4a2239ff883d6ac5","cpes":["cpe:2.3:a:redhat:nano:8.1-3.el10:*:*:*:*:*:*:*","cpe:2.3:a:nano:nano:8.1-3.el10:*:*:*:*:*:*:*"],"name":"nano","purl":"pkg:rpm/redhat/nano@8.1-3.el10?arch=x86_64&distro=rhel-10.2&upstream=nano-8.1-3.el10.src.rpm","type":"rpm","version":"8.1-3.el10","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6843","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"nano","version":"0:8.1-3.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6843","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6843","cwe":"CWE-134","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6843","date":"2026-10-19","epss":0.00147,"percentile":0.03552}],"risk":0.077175,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6843","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application."},"relatedVulnerabilities":[{"id":"CVE-2026-6843","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6843","cwe":"CWE-134","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6843","date":"2026-10-19","epss":0.00147,"percentile":0.03552}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6843","https://bugzilla.redhat.com/show_bug.cgi?id=2460017"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6843","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66864","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-66864","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66864","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66864","date":"2026-10-19","epss":0.00244,"percentile":0.14578}],"risk":0.07685999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-66864","description":"A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a NULL pointer dereference in the d_print_comp_inner function in the cp-demangle.c file, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-66864","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66864","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66864","date":"2026-10-19","epss":0.00244,"percentile":0.14578}],"urls":["https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash5.md"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66864","description":"An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file."}]},{"artifact":{"id":"7fa59f45815a51f1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:3.5.8-1.el10_2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@3.5.8-1.el10_2?arch=x86_64&distro=rhel-10.2&epoch=1&upstream=openssl-3.5.8-1.el10_2.src.rpm","type":"rpm","version":"1:3.5.8-1.el10_2","language":"","licenses":["Apache-2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.8-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42771","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"openssl","version":"3.5.8-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-42771","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42771","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42771","date":"2026-10-19","epss":0.0016,"percentile":0.0482}],"risk":0.076,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42771","description":"A flaw was found in OpenSSL. When an application uses the X509_VERIFY_PARAM_set1_email() function to validate a specially crafted S/MIME (Secure/Multipurpose Internet Mail Extensions) email address, an out-of-bounds read can occur. A remote attacker could exploit this vulnerability by sending a malicious email, leading to an application crash and a Denial of Service (DoS). This issue does not directly expose sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-42771","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42771","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42771","date":"2026-10-19","epss":0.0016,"percentile":0.0482}],"urls":["https://github.com/openssl/openssl/commit/6cd187689f8180c1f8a3acde21f88190c4a20de7","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42771","description":"Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an\napplication to validate a crafted e-mail address, such as during S/MIME\nmessage validation, an out of bounds read can happen.\n\nImpact summary: This out of bounds read will not directly exfiltrate\nthe data read to the attacker so the most likely result is a crash and\na Denial of Service.\n\nAn internal helper function called from X509_VERIFY_PARAM_[set|add]_email()\nused a wrong length when validating the local part of an email address.\nThis could cause the 64 octet limit on the local part of an email address\nto be not enforced, or cause an out of bound read and potentially a crash.\n\nThe bug is reachable via S-MIME validation with a crafted From: address\nsupplied in an email message that can potentially cause a crash.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44605","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-44605","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"risk":0.07565,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-44605","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44605","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-44605","date":"2026-10-19","epss":0.00178,"percentile":0.06981}],"urls":["https://access.redhat.com/errata/RHSA-2026:33507","https://access.redhat.com/security/cve/CVE-2026-44605","https://bugzilla.redhat.com/show_bug.cgi?id=2482481"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11495","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11495","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-11495","date":"2026-10-19","epss":0.00237,"percentile":0.13726}],"risk":0.07465499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11495","description":"A heap based buffer overflow flaw has been discovered in the GNU Binutils package. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally."},"relatedVulnerabilities":[{"id":"CVE-2025-11495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11495","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11495","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-11495","date":"2026-10-19","epss":0.00237,"percentile":0.13726}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16393","https://sourceware.org/bugzilla/show_bug.cgi?id=33502","https://sourceware.org/bugzilla/show_bug.cgi?id=33502#c3","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0","https://vuldb.com/?ctiid.327620","https://vuldb.com/?id.327620","https://vuldb.com/?submit.668290","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11495","description":"A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch."}]},{"artifact":{"id":"88615b9c65c046d5","cpes":["cpe:2.3:a:elfutils-default-yama-scope:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama-scope:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-default-yama-scope:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_default_yama_scope:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-default-yama-scope","purl":"pkg:rpm/redhat/elfutils-default-yama-scope@0.194-2.el10_2?arch=noarch&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1371","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1371","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1371","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1371","date":"2026-10-19","epss":0.00233,"percentile":0.13301}],"risk":0.07339499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1371","description":"A flaw was found in GNU elfutils. This vulnerability allows a NULL pointer dereference via the handle_dynamic_symtab function in readelf.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1371","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1371","date":"2026-10-19","epss":0.00233,"percentile":0.13301}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15926","https://sourceware.org/bugzilla/show_bug.cgi?id=32655","https://sourceware.org/bugzilla/show_bug.cgi?id=32655#c2","https://vuldb.com/?ctiid.295978","https://vuldb.com/?id.295978","https://vuldb.com/?submit.496484","https://www.gnu.org/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1371","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"b6a3e05d2eda9579","cpes":["cpe:2.3:a:elfutils-libelf:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libelf:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libelf:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libelf:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-libelf","purl":"pkg:rpm/redhat/elfutils-libelf@0.194-2.el10_2?arch=x86_64&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1371","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1371","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1371","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1371","date":"2026-10-19","epss":0.00233,"percentile":0.13301}],"risk":0.07339499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1371","description":"A flaw was found in GNU elfutils. This vulnerability allows a NULL pointer dereference via the handle_dynamic_symtab function in readelf.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1371","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1371","date":"2026-10-19","epss":0.00233,"percentile":0.13301}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15926","https://sourceware.org/bugzilla/show_bug.cgi?id=32655","https://sourceware.org/bugzilla/show_bug.cgi?id=32655#c2","https://vuldb.com/?ctiid.295978","https://vuldb.com/?id.295978","https://vuldb.com/?submit.496484","https://www.gnu.org/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1371","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"d718f6f178ab9612","cpes":["cpe:2.3:a:elfutils-libs:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libs:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libs:0.194-2.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libs:0.194-2.el10_2:*:*:*:*:*:*:*"],"name":"elfutils-libs","purl":"pkg:rpm/redhat/elfutils-libs@0.194-2.el10_2?arch=x86_64&distro=rhel-10.2&upstream=elfutils-0.194-2.el10_2.src.rpm","type":"rpm","version":"0.194-2.el10_2","language":"","licenses":["GPL-2.0-or-later OR LGPL-3.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.194-2.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1371","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"elfutils","version":"0.194-2.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-1371","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1371","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1371","date":"2026-10-19","epss":0.00233,"percentile":0.13301}],"risk":0.07339499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1371","description":"A flaw was found in GNU elfutils. This vulnerability allows a NULL pointer dereference via the handle_dynamic_symtab function in readelf.c."},"relatedVulnerabilities":[{"id":"CVE-2025-1371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1371","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1371","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1371","date":"2026-10-19","epss":0.00233,"percentile":0.13301}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15926","https://sourceware.org/bugzilla/show_bug.cgi?id=32655","https://sourceware.org/bugzilla/show_bug.cgi?id=32655#c2","https://vuldb.com/?ctiid.295978","https://vuldb.com/?id.295978","https://vuldb.com/?submit.496484","https://www.gnu.org/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1371","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5916","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5916","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5916","date":"2026-10-19","epss":0.00211,"percentile":0.10787}],"risk":0.07279499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5916","description":"A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0."},"relatedVulnerabilities":[{"id":"CVE-2025-5916","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5916","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5916","date":"2026-10-19","epss":0.00211,"percentile":0.10787}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5916","https://bugzilla.redhat.com/show_bug.cgi?id=2370872","https://github.com/libarchive/libarchive/pull/2568","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5916","description":"A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0."}]},{"artifact":{"id":"80fd9b576ebdd803","cpes":["cpe:2.3:a:redhat:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.80.4-12.el10_2.22:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.80.4-12.el10_2.22?arch=x86_64&distro=rhel-10.2&upstream=glib2-2.80.4-12.el10_2.22.src.rpm","type":"rpm","version":"2.80.4-12.el10_2.22","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86469","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glib2","version":"0:2.80.4-12.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86469","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-10-19","epss":0.00141,"percentile":0.03063}],"risk":0.07261500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."},"relatedVulnerabilities":[{"id":"CVE-2026-86469","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-10-19","epss":0.00141,"percentile":0.03063}],"urls":["https://access.redhat.com/security/cve/CVE-2026-86469","https://bugzilla.redhat.com/show_bug.cgi?id=2473839","https://gitlab.gnome.org/GNOME/glib/-/blob/main/gio/glocalfileoutputstream.c","https://gitlab.gnome.org/GNOME/glib/-/work_items/4044"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."}]},{"artifact":{"id":"1e99e4c48d45099d","cpes":["cpe:2.3:a:gnutls:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.8.10-5.el10_2:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.8.10-5.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gnutls-3.8.10-5.el10_2.src.rpm","type":"rpm","version":"3.8.10-5.el10_2","language":"","licenses":["GPL-3.0-or-later AND LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88648","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gnutls","version":"0:3.8.10-5.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-88648","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-88648","date":"2026-10-19","epss":0.00117,"percentile":0.01558}],"risk":0.07254000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-88648","description":"A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority (CA) can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure (PKI) restrictions. This allows unauthorized certificates to be accepted as valid, potentially enabling the attacker to impersonate trusted domains and intercept secure communications."},"relatedVulnerabilities":[{"id":"CVE-2026-88648","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-88648","date":"2026-10-19","epss":0.00117,"percentile":0.01558}],"urls":["https://gist.github.com/lkloliver/1f2a97cb8d0b31aa27b6bd0354358d7d","https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10","https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88648","description":"Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6845","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6845","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6845","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6845","date":"2026-10-19","epss":0.00145,"percentile":0.03363}],"risk":0.0725,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6845","description":"A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash."},"relatedVulnerabilities":[{"id":"CVE-2026-6845","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6845","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6845","date":"2026-10-19","epss":0.00145,"percentile":0.03363}],"urls":["https://access.redhat.com/errata/RHSA-2026:34924","https://access.redhat.com/errata/RHSA-2026:39022","https://access.redhat.com/security/cve/CVE-2026-6845","https://bugzilla.redhat.com/show_bug.cgi?id=2460012"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6845","description":"A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"705125d60490332a","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"6180bca70e43fdf3","cpes":["cpe:2.3:a:redhat:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"0:4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"de6a43d40e394173","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"36135670b7e8cca7","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later OR LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103242","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-103242","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-103242","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103242","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103242","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103242","https://bugzilla.redhat.com/show_bug.cgi?id=2543866"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103242","description":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}]},{"artifact":{"id":"83dc87adda3b2fcc","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.19.1.1-23.el10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.19.1.1-23.el10:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/redhat/rpm-sign-libs@4.19.1.1-23.el10?arch=x86_64&distro=rhel-10.2&upstream=rpm-4.19.1.1-23.el10.src.rpm","type":"rpm","version":"4.19.1.1-23.el10","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.19.1.1-23.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95520","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rpm","version":"4.19.1.1-23.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-95520","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"risk":0.071995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."},"relatedVulnerabilities":[{"id":"CVE-2026-95520","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95520","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95520","date":"2026-10-19","epss":0.00119,"percentile":0.01659}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95520","https://bugzilla.redhat.com/show_bug.cgi?id=2537809"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95520","description":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-19","epss":0.00144,"percentile":0.03298}],"risk":0.07128000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18374","description":"A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-19","epss":0.00144,"percentile":0.03298}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-19","epss":0.00144,"percentile":0.03298}],"risk":0.07128000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18374","description":"A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-19","epss":0.00144,"percentile":0.03298}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-145.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"< 0:2.39-145.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"fixed","versions":["0:2.39-145.el10_2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:2.39-145.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-19","epss":0.00144,"percentile":0.03298}],"risk":0.07128000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:84753","link":"https://access.redhat.com/errata/RHSA-2026:84753"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18374","description":"A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-19","epss":0.00144,"percentile":0.03298}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69651","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69651","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69651","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69651","date":"2026-10-19","epss":0.00244,"percentile":0.14659}],"risk":0.07075999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69651","description":"A flaw was found in binutils. An attacker could exploit this vulnerability by providing a crafted Executable and Linkable Format (ELF) binary with malformed relocation or symbol data. Processing this malicious binary leads to an invalid pointer free, which triggers memory corruption checks and causes the program to terminate."},"relatedVulnerabilities":[{"id":"CVE-2025-69651","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69651","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69651","date":"2026-10-19","epss":0.00244,"percentile":0.14659}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33698","https://sourceware.org/bugzilla/show_bug.cgi?id=33700","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=81e90cf63a10ad11772c2437c8f2a88f1a00c739","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=ea4bc025abdba85a90e26e13f551c16a44bfa92","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69651","description":"GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version."}]},{"artifact":{"id":"09e91b8809c6d39c","cpes":["cpe:2.3:a:redhat:pam:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam:pam:1.6.1-9.el10_2.1:*:*:*:*:*:*:*"],"name":"pam","purl":"pkg:rpm/redhat/pam@1.6.1-9.el10_2.1?arch=x86_64&distro=rhel-10.2&upstream=pam-1.6.1-9.el10_2.1.src.rpm","type":"rpm","version":"1.6.1-9.el10_2.1","language":"","licenses":["BSD-3-Clause AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12610","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pam","version":"0:1.6.1-9.el10_2.1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-12610","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-10-19","epss":0.00121,"percentile":0.01775}],"risk":0.06897,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."},"relatedVulnerabilities":[{"id":"CVE-2026-12610","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-10-19","epss":0.00121,"percentile":0.01775}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12610","https://bugzilla.redhat.com/show_bug.cgi?id=2490288","https://github.com/SSSD/sssd/issues/8796"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."}]},{"artifact":{"id":"06bca5f3c352e683","cpes":["cpe:2.3:a:pam-libs:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam-libs:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam_libs:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam_libs:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam:pam-libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*","cpe:2.3:a:pam:pam_libs:1.6.1-9.el10_2.1:*:*:*:*:*:*:*"],"name":"pam-libs","purl":"pkg:rpm/redhat/pam-libs@1.6.1-9.el10_2.1?arch=x86_64&distro=rhel-10.2&upstream=pam-1.6.1-9.el10_2.1.src.rpm","type":"rpm","version":"1.6.1-9.el10_2.1","language":"","licenses":["BSD-3-Clause AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pam","version":"1.6.1-9.el10_2.1"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12610","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"pam","version":"1.6.1-9.el10_2.1"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-12610","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-10-19","epss":0.00121,"percentile":0.01775}],"risk":0.06897,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."},"relatedVulnerabilities":[{"id":"CVE-2026-12610","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12610","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12610","date":"2026-10-19","epss":0.00121,"percentile":0.01775}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12610","https://bugzilla.redhat.com/show_bug.cgi?id=2490288","https://github.com/SSSD/sssd/issues/8796"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12610","description":"A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit."}]},{"artifact":{"id":"0b8e2bc35bf803f9","cpes":["cpe:2.3:a:vim-data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_data:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_data:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-data","purl":"pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.22?arch=noarch&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-9389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9389","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-9389","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-9389","date":"2026-10-19","epss":0.00215,"percentile":0.11172}],"risk":0.067725,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9389","description":"A memory corruption vulnerability was found in the Vim, where the flaw resides in the __memmove_avx_unaligned_erms() function, located in the memmove-vec-unaligned-erms.S file. The vulnerability is caused by improper handling of memory operations within this function, which can be triggered when a user opens a specially crafted file. An attacker on the local system can exploit this flaw to cause the Vim application to crash. This crash leads to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-9389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9389","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-9389","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-9389","date":"2026-10-19","epss":0.00215,"percentile":0.11172}],"urls":["https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing","https://github.com/vim/vim/issues/17940","https://github.com/vim/vim/issues/17940#issuecomment-3203415781","https://vuldb.com/?ctiid.321222","https://vuldb.com/?id.321222","https://vuldb.com/?submit.630898"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9389","description":"A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, \"when coloring is turned on\"."}]},{"artifact":{"id":"eac78d8b518f1573","cpes":["cpe:2.3:a:vim-minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim-minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim_minimal:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:redhat:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_minimal:2\\:9.1.083-9.el10_2.22:*:*:*:*:*:*:*"],"name":"vim-minimal","purl":"pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.22?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=vim-9.1.083-9.el10_2.22.src.rpm","type":"rpm","version":"2:9.1.083-9.el10_2.22","language":"","licenses":["Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"vim","version":"9.1.083-9.el10_2.22"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"vim","version":"9.1.083-9.el10_2.22"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-9389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9389","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-9389","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-9389","date":"2026-10-19","epss":0.00215,"percentile":0.11172}],"risk":0.067725,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-9389","description":"A memory corruption vulnerability was found in the Vim, where the flaw resides in the __memmove_avx_unaligned_erms() function, located in the memmove-vec-unaligned-erms.S file. The vulnerability is caused by improper handling of memory operations within this function, which can be triggered when a user opens a specially crafted file. An attacker on the local system can exploit this flaw to cause the Vim application to crash. This crash leads to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-9389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9389","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-9389","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-9389","date":"2026-10-19","epss":0.00215,"percentile":0.11172}],"urls":["https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing","https://github.com/vim/vim/issues/17940","https://github.com/vim/vim/issues/17940#issuecomment-3203415781","https://vuldb.com/?ctiid.321222","https://vuldb.com/?id.321222","https://vuldb.com/?submit.630898"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9389","description":"A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, \"when coloring is turned on\"."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11494","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11494","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11494","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11494","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11494","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11494","date":"2026-10-19","epss":0.00213,"percentile":0.10954}],"risk":0.06709499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11494","description":"An out of bounds read flaw has been discovered in the GNU Binutils package. The impacted function is _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally."},"relatedVulnerabilities":[{"id":"CVE-2025-11494","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11494","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11494","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11494","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11494","date":"2026-10-19","epss":0.00213,"percentile":0.10954}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16389","https://sourceware.org/bugzilla/show_bug.cgi?id=33499","https://sourceware.org/bugzilla/show_bug.cgi?id=33499#c2","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a","https://vuldb.com/?ctiid.327619","https://vuldb.com/?id.327619","https://vuldb.com/?submit.668281","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11494","description":"A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue."}]},{"artifact":{"id":"38101621fb6ae42d","cpes":["cpe:2.3:a:python3:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:rpm/redhat/python3@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0864","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0864","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0864","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0864","date":"2026-10-19","epss":0.00126,"percentile":0.02068}],"risk":0.06615000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0864","description":"A flaw was found in the Python `configparser` module. When writing configuration files, an attacker who controls the input value can inject unexpected keys and values. This occurs if the input contains multi-line text with carriage return characters, leading to potential configuration manipulation."},"relatedVulnerabilities":[{"id":"CVE-2026-0864","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0864","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0864","date":"2026-10-19","epss":0.00126,"percentile":0.02068}],"urls":["https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528","https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd","https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908","https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f","https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98","https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8","https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6","https://github.com/python/cpython/issues/143927","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0864","description":"When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."}]},{"artifact":{"id":"a5a4ab3060a72f21","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.12.14-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.12.14-1.el10_2:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.12.14-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=python3.12-3.12.14-1.el10_2.src.rpm","type":"rpm","version":"3.12.14-1.el10_2","language":"","licenses":["Python-2.0.1 AND CC0-1.0"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3.12","version":"3.12.14-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0864","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"python3.12","version":"3.12.14-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-0864","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0864","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0864","date":"2026-10-19","epss":0.00126,"percentile":0.02068}],"risk":0.06615000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0864","description":"A flaw was found in the Python `configparser` module. When writing configuration files, an attacker who controls the input value can inject unexpected keys and values. This occurs if the input contains multi-line text with carriage return characters, leading to potential configuration manipulation."},"relatedVulnerabilities":[{"id":"CVE-2026-0864","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0864","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0864","date":"2026-10-19","epss":0.00126,"percentile":0.02068}],"urls":["https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528","https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd","https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908","https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f","https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98","https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8","https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6","https://github.com/python/cpython/issues/143927","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0864","description":"When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."}]},{"artifact":{"id":"c3fc14f6b812f15a","cpes":["cpe:2.3:a:libarchive:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.7.7-11.el10_2:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.7.7-11.el10_2?arch=x86_64&distro=rhel-10.2&upstream=libarchive-3.7.7-11.el10_2.src.rpm","type":"rpm","version":"3.7.7-11.el10_2","language":"","licenses":["BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5917","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"libarchive","version":"0:3.7.7-11.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-5917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5917","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5917","date":"2026-10-19","epss":0.00226,"percentile":0.12419}],"risk":0.06553999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5917","description":"A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0."},"relatedVulnerabilities":[{"id":"CVE-2025-5917","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5917","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5917","date":"2026-10-19","epss":0.00226,"percentile":0.12419}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5917","https://bugzilla.redhat.com/show_bug.cgi?id=2370874","https://github.com/libarchive/libarchive/pull/2588","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5917","description":"A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0."}]},{"artifact":{"id":"8536ecf4741187d2","cpes":["cpe:2.3:a:redhat:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.35-13.el10_2:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.35-13.el10_2?arch=x86_64&distro=rhel-10.2&epoch=2&upstream=tar-1.35-13.el10_2.src.rpm","type":"rpm","version":"2:1.35-13.el10_2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-64118","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"tar","version":"2:1.35-13.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-64118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64118","cwe":"CWE-362","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-64118","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64118","date":"2026-10-19","epss":0.00134,"percentile":0.02616}],"risk":0.06499,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-64118","description":"A flaw was found in node-tar, a Tar utility for Node.js. This vulnerability allows a local attacker to potentially disclose sensitive information. When the .t (or .list) function is used with { sync: true } to read tar entry contents, and the tar file is concurrently modified on disk to a smaller size, the function may return uninitialized memory contents. This could lead to the exposure of arbitrary data."},"relatedVulnerabilities":[{"id":"CVE-2025-64118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64118","cwe":"CWE-362","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-64118","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-64118","date":"2026-10-19","epss":0.00134,"percentile":0.02616}],"urls":["https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d","https://github.com/isaacs/node-tar/issues/445","https://github.com/isaacs/node-tar/pull/446","https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64118","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11412","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11412","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11412","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11412","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11412","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11412","date":"2026-10-19","epss":0.00203,"percentile":0.09685}],"risk":0.063945,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11412","description":"A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the bfd_elf_gc_record_vtentry function in the bfd/elflink.c file due to a missing sanity check, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-11412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11412","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11412","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11412","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11412","date":"2026-10-19","epss":0.00203,"percentile":0.09685}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16378","https://sourceware.org/bugzilla/show_bug.cgi?id=33452","https://sourceware.org/bugzilla/show_bug.cgi?id=33452#c8","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc","https://vuldb.com/?ctiid.327348","https://vuldb.com/?id.327348","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11412","description":"A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11414","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-11414","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11414","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11414","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11414","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11414","date":"2026-10-19","epss":0.00203,"percentile":0.09685}],"risk":0.063945,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11414","description":"A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the get_link_hash_entry function in the bfd/elflink.c file due to an improper check, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-11414","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11414","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11414","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-11414","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-11414","date":"2026-10-19","epss":0.00203,"percentile":0.09685}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=16361","https://sourceware.org/bugzilla/show_bug.cgi?id=33450","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aeaaa9af6359c8e394ce9cf24911fec4f4d23703","https://vuldb.com/?ctiid.327350","https://vuldb.com/?id.327350","https://vuldb.com/?submit.665591","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11414","description":"A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component."}]},{"artifact":{"id":"beb40ba9101c0bc0","cpes":["cpe:2.3:a:systemd:systemd:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/redhat/systemd@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"0:257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-19","epss":0.00119,"percentile":0.01647}],"risk":0.06247500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-19","epss":0.00119,"percentile":0.01647}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"a180667717d94fe1","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"257-23.el10_2.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-19","epss":0.00119,"percentile":0.01647}],"risk":0.06247500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-19","epss":0.00119,"percentile":0.01647}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"7d7d4c86dfd32268","cpes":["cpe:2.3:a:systemd-pam:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-pam:257-23.el10_2.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_pam:257-23.el10_2.2:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/redhat/systemd-pam@257-23.el10_2.2?arch=x86_64&distro=rhel-10.2&upstream=systemd-257-23.el10_2.2.src.rpm","type":"rpm","version":"257-23.el10_2.2","language":"","licenses":["LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"257-23.el10_2.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15059","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"systemd","version":"257-23.el10_2.2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-15059","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-19","epss":0.00119,"percentile":0.01647}],"risk":0.06247500000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-15059","description":"A flaw was found in systemd-oomd. Local unprivileged users can exploit a missing path traversal validation in the systemd-oomd Inter-Process Communication (IPC) Application Programming Interface (API). This vulnerability allows them to terminate arbitrary local processes, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-15059","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15059","cwe":"CWE-22","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"},{"cve":"CVE-2026-15059","cwe":"CWE-59","type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c"}],"epss":[{"cve":"CVE-2026-15059","date":"2026-10-19","epss":0.00119,"percentile":0.01647}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15059","description":"Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56405","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-56405","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56405","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56405","date":"2026-10-19","epss":0.00125,"percentile":0.0196}],"risk":0.061875000000000006,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-56405","description":"A flaw was found in libexpat. An integer overflow vulnerability exists within the `getAttributeId` function. This flaw could allow an attacker to potentially disclose sensitive information or execute arbitrary code, leading to a compromise of the system's integrity and confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2026-56405","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56405","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56405","date":"2026-10-19","epss":0.00125,"percentile":0.0196}],"urls":["https://github.com/libexpat/libexpat/pull/1251"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56405","description":"libexpat before 2.8.2 has an integer overflow in getAttributeId."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-66382","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-66382","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-10-19","epss":0.00203,"percentile":0.09643}],"risk":0.05988500000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-66382","description":"A flaw was found in libexpat. This vulnerability allows a denial of service (DoS) by processing a crafted file with an approximate size of 2 MiB, leading to dozens of seconds of processing time."},"relatedVulnerabilities":[{"id":"CVE-2025-66382","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-10-19","epss":0.00203,"percentile":0.09643}],"urls":["https://github.com/libexpat/libexpat/issues/1076","http://www.openwall.com/lists/oss-security/2025/12/02/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66382","description":"In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.0582,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.0582,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.0582,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86805","description":"A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled."},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"722a41d78d12e19d","cpes":["cpe:2.3:a:libblkid:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"c5bba4859217b0b1","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"b09acb9cbc9bcae1","cpes":["cpe:2.3:a:libmount:libmount:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"86230e3c675a9ec8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"a12e1e5baa7f89b5","cpes":["cpe:2.3:a:libuuid:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["BSD-3-Clause"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"e4ea3d978fd9a9cc","cpes":["cpe:2.3:a:util-linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND EUPL-1.2 AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"0:2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"30e149b22a68c3c9","cpes":["cpe:2.3:a:util-linux-core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux-core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux_core:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux-core:2.40.2-18.el10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux_core:2.40.2-18.el10:*:*:*:*:*:*:*"],"name":"util-linux-core","purl":"pkg:rpm/redhat/util-linux-core@2.40.2-18.el10?arch=x86_64&distro=rhel-10.2&upstream=util-linux-2.40.2-18.el10.src.rpm","type":"rpm","version":"2.40.2-18.el10","language":"","licenses":["GPL-2.0-only AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.40.2-18.el10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27456","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"util-linux","version":"2.40.2-18.el10"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-27456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"risk":0.057229999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-27456","description":"A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents."},"relatedVulnerabilities":[{"id":"CVE-2026-27456","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27456","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27456","cwe":"CWE-367","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27456","date":"2026-10-19","epss":0.00118,"percentile":0.01592}],"urls":["https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","description":"util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69652","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69652","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69652","cwe":"CWE-460","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69652","date":"2026-10-19","epss":0.00179,"percentile":0.07058}],"risk":0.056384999999999984,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69652","description":"A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF abbrev or debug information with the readelf program using the -w abbrev command line option can trigger an abort, causing a crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-69652","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69652","cwe":"CWE-460","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69652","date":"2026-10-19","epss":0.00179,"percentile":0.07058}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33701","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=44b79abd0fa12e7947252eb4c6e5d16ed6033e01"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69652","description":"GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69648","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69648","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69648","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69648","date":"2026-10-19","epss":0.00179,"percentile":0.07041}],"risk":0.056384999999999984,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69648","description":"A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF .debug_rnglists data with the readelf program can trigger an infinite loop and result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-69648","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69648","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69648","date":"2026-10-19","epss":0.00179,"percentile":0.07041}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33641","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69648","description":"GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed."}]},{"artifact":{"id":"7363ec55a4085ae1","cpes":["cpe:2.3:a:redhat:glibc:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6368","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"0:2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6368","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6368","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6368","date":"2026-10-19","epss":0.00107,"percentile":0.01084}],"risk":0.056174999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6368","description":"A flaw was found in glibc (GNU C Library). A local attacker or application using the wordexp function with the WRDE_APPEND flag can trigger the interface to return invalid memory in the we_wordv member. This invalid memory, when subsequently processed by wordfree, may cause the process to abort, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-6368","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Green","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6368","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6368","date":"2026-10-19","epss":0.00107,"percentile":0.01084}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34090","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6368","description":"Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"ec4fedac38797dc4","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6368","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6368","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6368","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6368","date":"2026-10-19","epss":0.00107,"percentile":0.01084}],"risk":0.056174999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6368","description":"A flaw was found in glibc (GNU C Library). A local attacker or application using the wordexp function with the WRDE_APPEND flag can trigger the interface to return invalid memory in the we_wordv member. This invalid memory, when subsequently processed by wordfree, may cause the process to abort, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-6368","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Green","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6368","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6368","date":"2026-10-19","epss":0.00107,"percentile":0.01084}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34090","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6368","description":"Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"6e3afd8297d6e3b4","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.39-128.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.39-128.el10_2:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.39-128.el10_2?arch=x86_64&distro=rhel-10.2&upstream=glibc-2.39-128.el10_2.src.rpm","type":"rpm","version":"2.39-128.el10_2","language":"","licenses":["LGPL-2.1-or-later AND SunPro AND LGPL-2.1-or-later WITH GCC-exception-2.0 AND BSD-3-Clause AND GPL-2.0-or-later AND LGPL-2.1-or-later WITH GNU-compiler-exception AND GPL-2.0-only AND ISC AND LicenseRef-Fedora-Public-Domain AND HPND AND CMU-Mach AND LGPL-2.1-only AND LGPL-2.0-or-later AND Unicode-DFS-2015 AND GFDL-1.1-or-later AND GPL-1.0-or-later AND FSFUL AND MIT AND Inner-Net-2.0 AND X11 AND GPL-2.0-or-later WITH GCC-exception-2.0 AND GFDL-1.3-only AND GFDL-1.1-only AND GPL-3.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic-3.0 AND GPL-3.0-or-later WITH Texinfo-exception"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.39-128.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.39-142.el10_2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6368","versionConstraint":"< 0:2.39-142.el10_2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"glibc","version":"2.39-128.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-6368","fix":{"state":"fixed","versions":["0:2.39-142.el10_2"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"0:2.39-142.el10_2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6368","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6368","date":"2026-10-19","epss":0.00107,"percentile":0.01084}],"risk":0.056174999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[{"id":"RHSA-2026:76781","link":"https://access.redhat.com/errata/RHSA-2026:76781"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6368","description":"A flaw was found in glibc (GNU C Library). A local attacker or application using the wordexp function with the WRDE_APPEND flag can trigger the interface to return invalid memory in the we_wordv member. This invalid memory, when subsequently processed by wordfree, may cause the process to abort, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-6368","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Green","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6368","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6368","date":"2026-10-19","epss":0.00107,"percentile":0.01084}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34090","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6368","description":"Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"1f739352a341bdff","cpes":["cpe:2.3:a:redhat:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-14017","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"0:8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14017","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-19","epss":0.00114,"percentile":0.01386}],"risk":0.05585999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14017","description":"A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed."},"relatedVulnerabilities":[{"id":"CVE-2025-14017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-19","epss":0.00114,"percentile":0.01386}],"urls":["https://curl.se/docs/CVE-2025-14017.html","https://curl.se/docs/CVE-2025-14017.json","http://www.openwall.com/lists/oss-security/2026/01/07/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","description":"When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."}]},{"artifact":{"id":"011ce142cadf9ee2","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl-minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl_minimal:8.12.1-4.el10_2.6:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.6?arch=x86_64&distro=rhel-10.2&upstream=curl-8.12.1-4.el10_2.6.src.rpm","type":"rpm","version":"8.12.1-4.el10_2.6","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.12.1-4.el10_2.6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14017","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"curl","version":"8.12.1-4.el10_2.6"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-14017","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-19","epss":0.00114,"percentile":0.01386}],"risk":0.05585999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14017","description":"A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed."},"relatedVulnerabilities":[{"id":"CVE-2025-14017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-19","epss":0.00114,"percentile":0.01386}],"urls":["https://curl.se/docs/CVE-2025-14017.html","https://curl.se/docs/CVE-2025-14017.json","http://www.openwall.com/lists/oss-security/2026/01/07/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","description":"When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24515","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-24515","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24515","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24515","date":"2026-10-19","epss":0.00186,"percentile":0.07753}],"risk":0.05487,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-24515","description":"A null pointer dereference flaw has been discovered in libexpat. The function `XML_ExternalEntityParserCreate` failed to copy the encoding handler data passed to XML_SetUnknownEncodingHandler from the parent to the new subparser. This can cause a NULL dereference from external entities that declare use of an unknown encoding. The expected impact is denial of service. It takes use of both functions `XML_ExternalEntityParserCreate` and `XML_SetUnknownEncodingHandler` for an application to be vulnerable."},"relatedVulnerabilities":[{"id":"CVE-2026-24515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24515","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24515","date":"2026-10-19","epss":0.00186,"percentile":0.07753}],"urls":["https://github.com/libexpat/libexpat/pull/1131","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24515","description":"In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data."}]},{"artifact":{"id":"870fbed286dbcd29","cpes":["cpe:2.3:a:redhat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.7.3-1.el10_2.5:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.7.3-1.el10_2.5?arch=x86_64&distro=rhel-10.2&upstream=expat-2.7.3-1.el10_2.5.src.rpm","type":"rpm","version":"2.7.3-1.el10_2.5","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76957","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"expat","version":"0:2.7.3-1.el10_2.5"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-76957","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76957","date":"2026-10-19","epss":0.00107,"percentile":0.01061}],"risk":0.052965,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76957","description":"A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-76957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76957","date":"2026-10-19","epss":0.00107,"percentile":0.01061}],"urls":["https://github.com/libexpat/libexpat/pull/1322","https://github.com/libexpat/libexpat/pull/1329"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76957","description":"libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412."}]},{"artifact":{"id":"18a5b947a6d195a9","cpes":["cpe:2.3:a:rpm-sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sequoia:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sequoia:1.10.2.1-1.el10_2:*:*:*:*:*:*:*"],"name":"rpm-sequoia","purl":"pkg:rpm/redhat/rpm-sequoia@1.10.2.1-1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=rust-rpm-sequoia-1.10.2.1-1.el10_2.src.rpm","type":"rpm","version":"1.10.2.1-1.el10_2","language":"","licenses":["LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2625","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"rust-rpm-sequoia","version":"1.10.2.1-1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2026-2625","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2625","cwe":"CWE-347","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2625","date":"2026-10-19","epss":0.00114,"percentile":0.01395}],"risk":0.0513,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-2625","description":"A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification."},"relatedVulnerabilities":[{"id":"CVE-2026-2625","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2625","cwe":"CWE-347","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2625","date":"2026-10-19","epss":0.00114,"percentile":0.01395}],"urls":["https://access.redhat.com/errata/RHSA-2026:12682","https://access.redhat.com/security/cve/CVE-2026-2625","https://bugzilla.redhat.com/show_bug.cgi?id=2440357"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2625","description":"A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69645","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69645","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69645","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69645","date":"2026-10-19","epss":0.00173,"percentile":0.06315}],"risk":0.05017,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69645","description":"A flaw was found in binutils, specifically in the `objdump` utility. A local attacker can exploit this vulnerability by providing a specially crafted binary file containing malformed DWARF (Debugging With Attributed Record Formats) debug information. This can lead to a logic error during the processing of DWARF compilation units, causing the `objdump` utility to crash and resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-69645","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69645","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69645","date":"2026-10-19","epss":0.00173,"percentile":0.06315}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33637","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cdb728d4da6184631989b192f1022c219dea7677"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69645","description":"Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69647","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69647","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69647","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69647","date":"2026-10-19","epss":0.00158,"percentile":0.04503}],"risk":0.04976999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69647","description":"A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF loclists data with the readelf program can trigger an infinite loop and result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2025-69647","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69647","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69647","date":"2026-10-19","epss":0.00158,"percentile":0.04503}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33640","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69647","description":"GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis."}]},{"artifact":{"id":"d7f7a24c22f290c7","cpes":["cpe:2.3:a:gdb-gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb-gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb_gdbserver:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb-gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*","cpe:2.3:a:gdb:gdb_gdbserver:16.3-3.1.el10_2:*:*:*:*:*:*:*"],"name":"gdb-gdbserver","purl":"pkg:rpm/redhat/gdb-gdbserver@16.3-3.1.el10_2?arch=x86_64&distro=rhel-10.2&upstream=gdb-16.3-3.1.el10_2.src.rpm","type":"rpm","version":"16.3-3.1.el10_2","language":"","licenses":["GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/usr/lib/sysimage/rpm/rpmdb.sqlite","layerID":"sha256:8f29b48e49da7ebe76bff084667059c0cb17ecbb115f4cd034ed1d219b08c6f8","accessPath":"/usr/lib/sysimage/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gdb","version":"16.3-3.1.el10_2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69646","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"10.2"},"package":{"name":"gdb","version":"16.3-3.1.el10_2"},"namespace":"redhat:distro:redhat:10"}}],"vulnerability":{"id":"CVE-2025-69646","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69646","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69646","date":"2026-10-19","epss":0.00161,"percentile":0.0489}],"risk":0.04669,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:10","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69646","description":"A flaw was found in binutils. A local attacker can exploit this vulnerability by supplying a malicious input file containing malformed DWARF debug_rnglists data. This can cause the objdump tool to enter an unbounded logging loop, leading to excessive CPU and I/O usage and preventing analysis completion. This issue results in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2025-69646","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69646","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69646","date":"2026-10-19","epss":0.00161,"percentile":0.0489}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33638","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69646","description":"Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis."}]}],"grade":"F","score":"0.00","as_of":"2026-10-20T18:41:47.459Z","grype_db_version":"2026-10-20T06:29:49.000Z"}